Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe

Overview

General Information

Sample name:SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe
Analysis ID:1544572
MD5:2a3b7cf9d36c8e04db084638fd066ad5
SHA1:6e25322226e38e6e921cfacb631556cf66dd5b06
SHA256:1e5bc37886c1983546bcd39efce0d4bd05b88f57da45686b48a375676c43bc4e
Tags:exe
Infos:

Detection

Score:34
Range:0 - 100
Whitelisted:false
Confidence:0%

Compliance

Score:49
Range:0 - 100

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Contains functionality to register a low level keyboard hook
Found direct / indirect Syscall (likely to bypass EDR)
Installs a global event hook (focus changed)
Adds / modifies Windows certificates
Binary contains a suspicious time stamp
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
EXE planting / hijacking vulnerabilities found
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the installation date of Windows
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Stores large binary data to the registry
Tries to disable installed Antivirus / HIPS / PFW
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
query blbeacon for getting browser version

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe (PID: 3896 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe" MD5: 2A3B7CF9D36C8E04DB084638FD066AD5)
    • OperaGXInstaller.exe (PID: 4508 cmdline: "C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe" --silent --allusers=0 MD5: 8A3BD58257B48475AE9B793F522E5759)
      • setup.exe (PID: 3928 cmdline: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --silent --allusers=0 --server-tracking-blob=YzNjYzBkNzBjNDk4NTlkM2U3YTIzOTI2N2M2ZGIyMjU0OGQ2OWMxY2Y5YjZkMTY4MGI3OTJjMTc3ZDI3MGZkMjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInRpbWVzdGFtcCI6IjE3MzAyMTI2MjMuNTk2OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdpbjY0OyB4NjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoib2d4IiwiY29udGVudCI6Im9neGlfMzQ0MjAiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6Ik9GVCJ9LCJ1dWlkIjoiOWVkN2VlMTktY2FmYi00MTZkLTliNzQtMWI1ZGNkMDQwNWZiIn0= MD5: A910474AAD1EEA96921D359E1763D2FD)
        • setup.exe (PID: 6972 cmdline: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x32c,0x330,0x334,0x318,0x338,0x6c998c5c,0x6c998c68,0x6c998c74 MD5: A910474AAD1EEA96921D359E1763D2FD)
        • setup.exe (PID: 7164 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version MD5: A910474AAD1EEA96921D359E1763D2FD)
        • setup.exe (PID: 2788 cmdline: "C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241029103712" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C06000000000000 MD5: A910474AAD1EEA96921D359E1763D2FD)
          • setup.exe (PID: 712 cmdline: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x33c,0x340,0x344,0x308,0x318,0x6baf8c5c,0x6baf8c68,0x6baf8c74 MD5: A910474AAD1EEA96921D359E1763D2FD)
          • installer.exe (PID: 6856 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --backend --initial-pid=3928 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --install-subfolder=114.0.5282.123 MD5: E169C65773E40654455624EADD122953)
            • installer.exe (PID: 6684 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x250,0x254,0x27c,0x258,0x280,0x7ffd94469e20,0x7ffd94469e2c,0x7ffd94469e38 MD5: E169C65773E40654455624EADD122953)
            • explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
              • opera.exe (PID: 508 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized --lowered-browser MD5: 94851594215654A9EFCE5F3C3830A9C1)
            • EwdhIsAfAL.exe (PID: 2760 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 2420 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 1548 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 2532 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 6636 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 3552 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 4160 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 1460 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • opera.exe (PID: 5112 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized MD5: 94851594215654A9EFCE5F3C3830A9C1)
              • opera_crashreporter.exe (PID: 5004 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffd92de1388,0x7ffd92de1398,0x7ffd92de13a8 MD5: F2FDAF82F5AA813C34BF1E4065AF7CFA)
            • EwdhIsAfAL.exe (PID: 4156 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 5724 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 3800 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 524 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 3200 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 380 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
            • EwdhIsAfAL.exe (PID: 5668 cmdline: "C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 5172 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe" MD5: E9A2209B61F4BE34F25069A6E54AFFEA)
        • assistant_installer.exe (PID: 5768 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --version MD5: 4C8FBED0044DA34AD25F781C3D117A66)
          • assistant_installer.exe (PID: 6672 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x3a4f48,0x3a4f58,0x3a4f64 MD5: 4C8FBED0044DA34AD25F781C3D117A66)
  • opera_autoupdate.exe (PID: 5728 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --bypasslauncher 0 MD5: 84762F0101AE1F06BCB76F70A0308FD0)
    • opera_autoupdate.exe (PID: 6264 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x230,0x234,0x238,0x22c,0x208,0x7ff79d2f673c,0x7ff79d2f6748,0x7ff79d2f6758 MD5: 84762F0101AE1F06BCB76F70A0308FD0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: explorer.exe PID: 4004ironshell_phpSemi-Auto-generated - file ironshell.php.txtNeo23x0 Yara BRG + customization by Stefan -dfate- Molls
  • 0x548eb:$s2: ~ Shell I

Sigma Signatures

System Summary

barindex
Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe, ProcessId: 508, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera GX Stable

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeReversingLabs: Detection: 36%
Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_d3e9229a-c
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_gx_splash.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera.exeJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\notification_helper.exeJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeEXE: opera_crashreporter.exe
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer_helper_64.exeJump to behavior

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_gx_splash.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera.exeJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\notification_helper.exeJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeEXE: opera_crashreporter.exe
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeEXE: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer_helper_64.exeJump to behavior
Creates a software uninstall entry
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera GX 114.0.5282.123
Creates install or setup log file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103711306.logJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103713177.logJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeFile created: C:\Users\user\AppData\Local\Temp\assistant_installer_20241029103753.logJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103832254.log
PE / OLE file has a valid certificate
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: assistant_installer.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000D.00000000.2699731841.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000002.2702702953.0000000000385000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\opera.exe.pdb source: opera.exe, 0000001C.00000000.3147832863.00007FF627F7B000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3258373442.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000000.2268937215.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276417846.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000000.2272096796.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000000.2277827487.0000000000738000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000006.00000002.2281279697.0000000000738000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287434715.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000002.3218691525.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000000.2291188941.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227479724.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215572174.00007FF6E5804000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000000.3078708913.00007FF6E5804000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000002.3221323048.00007FF6E5804000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081813108.00007FF6E5804000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: browser_assistant.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: EwdhIsAfAL.exe, 00000013.00000000.3134208758.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000015.00000000.3136135528.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000016.00000000.3137495821.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000017.00000000.3138835530.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000018.00000000.3139903179.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000019.00000000.3140958934.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 0000001A.00000000.3142098587.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 0000001B.00000000.3145686226.000000000011E000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: mojo_core.dll.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Boo\Code\_Offergate\OperaGXInstaller\Build-x64-Release\OperaGXInstaller.pdb source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000000.2164793741.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\opera_autoupdate.exe.pdb source: installer.exe, 0000000F.00000003.3089669286.0000025C726A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: browser_assistant.exe.pdbe source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Boo\Code\_Offergate\OperaGXInstaller\Build-x64-Release\OperaGXInstaller.pdb source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000000.2164793741.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: assistant_installer.exe.pdb@ source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000D.00000000.2699731841.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000002.2702702953.0000000000385000.00000002.00000001.01000000.00000011.sdmp
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC59394 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF73CC59394
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D08D20 FindFirstFileW,3_2_00D08D20
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D2FEEB FindFirstFileExW,3_2_00D2FEEB
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_004033B3 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,12_2_004033B3
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_00402F12 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,12_2_00402F12
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00259120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,13_2_00259120
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002E9AE2 FindFirstFileExW,13_2_002E9AE2
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00259120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,14_2_00259120
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002E9AE2 FindFirstFileExW,14_2_002E9AE2
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Local\Programs\Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437126772788.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\doneJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC42FA0 SHGetFolderPathW,SHCreateDirectoryExW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,URLDownloadToFileW,ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,0_2_00007FF73CC42FA0
Source: Joe Sandbox ViewIP Address: 82.145.217.121 82.145.217.121
Source: Joe Sandbox ViewIP Address: 82.145.216.20 82.145.216.20
Source: Joe Sandbox ViewIP Address: 82.145.216.19 82.145.216.19
Source: Joe Sandbox ViewIP Address: 185.26.182.111 185.26.182.111
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC42FA0 SHGetFolderPathW,SHCreateDirectoryExW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,URLDownloadToFileW,ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,0_2_00007FF73CC42FA0
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: "favicon_url": "https://www.rambler.ru/favicon.ico", equals www.rambler.ru (Rambler)
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: "favicon_url": "https://www.yahoo.co.jp/favicon.ico", equals www.yahoo.com (Yahoo)
Source: installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/legal/terms; and equals www.facebook.com (Facebook)
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEDD000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2268290561.0000000000AF4000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621127258.000000003FA98000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: setup.exe, 00000004.00000003.3253008231.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.3107242903.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEDD000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621127258.000000003FA98000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621127258.000000003FA98000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: setup.exe, 00000004.00000003.2620618184.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620932026.00000000048C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com:80/DigiCertTrustedRootG4.crt
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2253117026.000002269FEDF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FEC5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2261697080.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2262600325.000002269FEE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEC7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325593647.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2301124369.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2342212159.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2314345754.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0.
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEDD000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2268290561.0000000000AF4000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621127258.000000003FA98000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.3107242903.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEDD000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621127258.000000003FA98000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: setup.exe, 00000004.00000003.3253008231.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.3107242903.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: setup.exe, 00000004.00000003.3253008231.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://localhost:3001api/prefs/?product=$1&version=$2..
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.3107242903.000000000978C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621127258.000000003FA98000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEDD000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2268290561.0000000000AF4000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621127258.000000003FA98000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: setup.exe, 00000004.00000003.3253008231.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
Source: setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0I
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEDD000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621127258.000000003FA98000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000F94000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3089772603.0000025C72693000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000002.3221950586.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: explorer.exe, 00000012.00000000.3107242903.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2253117026.000002269FEDF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FEC5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2261697080.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2262600325.000002269FEE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEC7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325593647.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2301124369.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2342212159.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2314345754.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: explorer.exe, 00000012.00000000.3105831810.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.3105794816.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.3094263658.00000000028A0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2253117026.000002269FEDF000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FEC5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2261697080.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FEBC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2262600325.000002269FEE0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEC7000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325593647.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2301124369.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2342212159.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2314345754.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: setup.exe, 00000004.00000003.3252788304.0000000004899000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3271500365.000000000489C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732108738.0000000004899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opera.com
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250168257.000002269FED3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250348085.000002269FEDD000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263897451.0000000004300000.00000004.00001000.00020000.00000000.sdmp, OperaGXInstaller.exe, 00000003.00000003.2263705690.0000000004180000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000F86000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2275615984.000000000393C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5D38000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000003.3086179334.0000025C70DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opera.com0
Source: setup.exe, 00000004.00000002.3271367338.0000000004880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opera.comq
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opera.comx
Source: opera.exe, 0000001C.00000002.3190948892.00000262B4FC0000.00000002.00000001.00040000.0000001C.sdmpString found in binary or memory: http://www.unicode.org/copyright.html
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/?q=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.spotify.com/
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.youtube.com
Source: explorer.exe, 00000012.00000000.3107242903.00000000099AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://addons.opera.com/en/extensions/details/dify-cashback/
Source: explorer.exe, 00000012.00000000.3110957749.000000000BFDF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.browser.yandex.ua/suggest/get?part=
Source: setup.exe, 00000004.00000003.2342212159.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325593647.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.config.opr.gg/
Source: setup.exe, 00000004.00000003.2620394310.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2342212159.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325593647.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517861970.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.config.opr.gg/0
Source: setup.exe, 00000004.00000003.2620394310.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2342212159.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325593647.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517861970.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.config.opr.gg/8
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://api.config.opr.gg/v0/config
Source: setup.exe, 00000004.00000003.2517760672.0000000000FA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.config.opr.gg/v0/config?utm_campaign=ogx&utm_medium=pb&utm_source=OFT&product=gx&channel
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://api.config.opr.gg/v0/configeditionutm_campaign=%s&utm_medium=%s&utm_source=%s&product=%s&cha
Source: explorer.exe, 00000012.00000000.3107242903.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000012.00000000.3107242903.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000012.00000000.3107242903.000000000962B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://appleid.apple.com
Source: explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: assistant_installer.exe, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/
Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003301000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/.opera.comOpera
Source: setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252788304.00000000048B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3271500365.00000000048B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/api/prefs/?product=Opera
Source: setup.exe, 00000004.00000003.3252654512.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252788304.00000000048B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/api/prefs/?product=Opera%20GX&version=114.0.5282.123
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/https://autoupdate.opera.com/me/OperaDesktopGXhttps://crashstats-co
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/gx/Stable/windows/x64
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/gx/Stable/windows/x642Q
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.opera.com/
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.opera.com/.
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000EDB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://autoupdate.opera.com/me/
Source: setup.exe, 00000004.00000002.3261130813.0000000000EDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.opera.com/me/m
Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://browser-notifications.opera.com/api/v1/
Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://browser-notifications.opera.com/api/v1/333333
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://consent.youtube.com
Source: assistant_installer.exe, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://crashpad.chromium.org/
Source: assistant_installer.exe, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://crashpad.chromium.org/bug/new
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003301000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: installer.exe, 00000010.00000002.3218122175.0000027DDB320000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000003.3216925350.00006F000002C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/
Source: setup.exe, 00000005.00000002.3277277382.000000000101B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000002.3277712898.0000000035614000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000008.00000002.3229100594.000000000112B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000008.00000002.3229889245.000000003E814000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/--annotation=channel=Stable--annotation=plat=Win32--annotat
Source: installer.exe, 00000010.00000002.3218122175.0000027DDB32F000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000003.3216925350.00006F000002C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/--annotation=channel=Stable--annotation=plat=Win64--annotat
Source: setup.exe, 00000005.00000002.3278224896.00000000356A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/5jA
Source: setup.exe, 00000005.00000002.3278224896.00000000356A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/5jB
Source: setup.exe, 00000005.00000002.3278224896.00000000356A4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/5jC
Source: installer.exe, 00000010.00000002.3220622111.00006F00000C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/o
Source: assistant_installer.exe, 0000000E.00000002.2703079898.0000000005039000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submit
Source: assistant_installer.exe, 0000000E.00000002.2703079898.0000000005039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submit--annotation=channel=Stable--annotation=plat=
Source: assistant_installer.exe, 0000000E.00000002.2703079898.0000000005051000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submit8
Source: assistant_installer.exe, 0000000E.00000002.2703079898.0000000005039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submit82
Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003301000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submitOperaDesktopGX
Source: assistant_installer.exe, 0000000E.00000002.2703079898.0000000005030000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000E.00000002.2703079898.0000000005039000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submitll
Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517861970.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2314345754.0000000000F42000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/L
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/P
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/T
Source: setup.exe, 00000004.00000003.2620394310.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/p
Source: setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/t
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/t=gx&channel=Stable&client=netinstaller&edition=
Source: setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/ta
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/tionBasic
Source: setup.exe, 00000004.00000002.3271367338.0000000004880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary
Source: setup.exe, 00000004.00000003.2620394310.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary7Y
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryA
Source: setup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryJ
Source: setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryS
Source: setup.exe, 00000004.00000003.2620394310.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2342212159.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517861970.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarydOIDInfo
Source: setup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarye.netLMEMP
Source: setup.exe, 00000004.00000003.2325673306.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryetmsg.dll.mui
Source: setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/wW
Source: setup.exe, 00000004.00000003.2342212159.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517861970.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/
Source: setup.exe, 00000004.00000002.3261130813.0000000000EDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/Z
Source: setup.exe, 00000004.00000003.2314219860.0000000000F7F000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3273664748.000000003F890000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3256956589.000000003F826000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3271367338.0000000004880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/download/get/?id=52318&autoupdate=1&ni=1
Source: setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/download/get/?id=52318&autoupdate=1&ni=1c
Source: setup.exe, 00000004.00000003.2517944427.0000000000F55000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732108738.0000000004899000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/download/get/?id=68353&autoupdate=1&ni=1&stream=stable&utm_campaign=ogx&u
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
Source: setup.exe, 00000004.00000002.3261130813.0000000000EDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/r
Source: setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/
Source: setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/??
Source: setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/A
Source: setup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/J
Source: setup.exe, 00000004.00000003.2732108738.0000000004899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/res/servicefiles/partner_content/std-2/1714144780-custom_partner_cont
Source: setup.exe, 00000004.00000003.2342212159.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3271367338.0000000004880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download5.operacdn.com/
Source: setup.exe, 00000004.00000003.2685766507.00000000048A3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732108738.0000000004899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download5.operacdn.com/ftp/pub/.assistant_gx/73.0.3856.382/Opera_GX_assistant_73.0.3856.382_
Source: setup.exe, 00000004.00000003.2732108738.0000000004899000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download5.operacdn.com/ftp/pub/opera_gx/114.0.5282.123/win/Opera_GX_114.0.5282.123_Autoupdat
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
Source: explorer.exe, 00000012.00000000.3110957749.000000000C048000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com-
Source: installer.exe, 0000000F.00000003.3142132099.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3142171103.000078B0001D8000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://extension-updates.opera.com/api/omaha/update/
Source: installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://extension-updates.opera.com/api/omaha/update/apple_ke
Source: installer.exe, 0000000F.00000003.3142132099.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3142171103.000078B0001D8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://extension-updates.opera.com/api/omaha/update/x
Source: setup.exe, 00000004.00000002.3271367338.0000000004880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/
Source: setup.exe, 00000004.00000003.2314133238.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325593647.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/9
Source: installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s
Source: setup.exe, 00000004.00000003.2325593647.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2314345754.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2314473101.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F74000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=af8f1523-0107-4b83-93
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ff.search.yahoo.com/gossip?output=fxjson&command=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gaana.com/
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://gamemaker.io
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://gamemaker.io)
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://gamemaker.io/en/education.
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://gamemaker.io/en/get.
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://help.instagram.com/581066165581870;
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://help.opera.com/latest/
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://legal.opera.com/eula/computers
Source: installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://legal.opera.com/privacy
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://legal.opera.com/privacy.
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://legal.opera.com/terms
Source: installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://legal.opera.com/terms.
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://listen.tidal.com/
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://listen.tidal.com/login
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FE9E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FE9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.tidal.com
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/at/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/au/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/be/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/bg/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/br/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/by/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ca/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ch/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/cn/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/cz/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/de/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/dk/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/eg/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/es/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/fi/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/fr/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/gb/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/hu/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/id/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/in/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/it/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/jp/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ke/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/kr/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/kz/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ma/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/mx/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/my/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ng/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/nl/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/no/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ph/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/pl/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ro/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/rs/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ru/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/se/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/sg/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/sk/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/th/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/tr/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ua/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/us/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/vn/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/za/browse
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.youtube.com
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FE9E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FE9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://net.geo.opera.com/
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FE9E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FE9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://net.geo.opera.com/J
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FE36000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FEC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FE9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://net.geo.opera.com/opera_gx/stable/edition/std-2/?utm_source=OFT&utm_medium=pb&utm_campaign=o
Source: installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nova.rambler.ru/suggest?v=3&query=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://oauth.play.pl/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://offer.tidal.com
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://open.spotify.com
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://opera.com/privacy
Source: explorer.exe, 00000012.00000000.3110957749.000000000C048000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.come
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://policies.google.com/terms;
Source: explorer.exe, 00000012.00000000.3110957749.000000000BFEF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comEMd
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://redir.opera.com/amazon/?q=
Source: installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://redir.opera.com/search/rambler/?q=
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://redir.opera.com/uninstallsurvey/
Source: installer.exe, 0000000F.00000002.3215206621.000078B0000E4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_mediu
Source: installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.seznam.cz/?q=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.yahoo.co.jp/search?ei=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.yahoo.com/favicon.ico
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.yahoo.com/search?ei=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://soundcloud.com/
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://sourcecode.opera.com
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://suggest.yandex.com.tr/suggest-opera?part=
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://telegram.org/tos/
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://translate.yandex.fr/?text=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://translate.yandex.net/main/v2.92.1465389915/i/favicon.ico
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://twitter.com/en/tos;
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/oauth
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000012.00000000.3110957749.000000000C048000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comM
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/favicon.ico
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/baidu?wd=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/favicon.ico
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/bg/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/br/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/cz/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/de/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/en/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/es/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/fi/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/fr/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/hu/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/id/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/it/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/mx/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/nl/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/no/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/pl/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/ro/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/ru/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/se/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/sk/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/sr/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/th/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/tr/login
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/us/login
Source: setup.exe, 00000004.00000002.3259855872.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F74000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685660080.000000000493A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3257155164.000000003F80C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3259855872.0000000000CA6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698678717.0000000000930000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=opera&q=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/favicon.ico
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?client=opera-gx&q=
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com:443/en-us/feed
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://www.opera.com
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://www.opera.com..
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://www.opera.com/gx/
Source: installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://www.opera.com/privacy
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rambler.ru/favicon.ico
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.seznam.cz/favicon.ico
Source: installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.so.com/favicon.ico
Source: installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.so.com/favicon.icocss/searchstyle_360.cssimages/logo_360.png
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.so.com/s?src=lm&ls=sm2297808&lm_extend=ctype:31&q=
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://www.whatsapp.com/legal;
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.yahoo.co.jp/favicon.ico
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yandex.com.tr/search/?clid=1669559&text=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yandex.fr/search/?clid=2358536&text=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yandex.ua/search/?clid=2358536&text=
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yastatic.net/s3/home-static/_/92/929b10d17990e806734f68758ec917ec.png
Source: installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yastatic.net/s3/home-static/_/f4/f47b1b3d8194c36ce660324ab55a04fe.png

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_00408643 SetWindowsHookExW 00000002,Function_00008615,00000000,0000000012_2_00408643
Installs a global event hook (focus changed)
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeWindows user hook set: Path: unknown Event Start:focus Event End: focus Module: NULL
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4Jump to dropped file

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00212770: CreateFileW,DeviceIoControl,GetLastError,13_2_00212770
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00254EE0 SetHandleInformation,SetHandleInformation,CreateEnvironmentBlock,CreateProcessAsUserW,DestroyEnvironmentBlock,GetEnvironmentStringsW,FreeEnvironmentStringsW,CreateProcessW,AssignProcessToJobObject,AllowSetForegroundWindow,WaitForSingleObject,13_2_00254EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC42FA00_2_00007FF73CC42FA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC428300_2_00007FF73CC42830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC5EDC80_2_00007FF73CC5EDC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC5AE680_2_00007FF73CC5AE68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC57FE80_2_00007FF73CC57FE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC5879C0_2_00007FF73CC5879C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC4EFC40_2_00007FF73CC4EFC4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC518B00_2_00007FF73CC518B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC5E87C0_2_00007FF73CC5E87C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC509FC0_2_00007FF73CC509FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC593940_2_00007FF73CC59394
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC5C3780_2_00007FF73CC5C378
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC4F4440_2_00007FF73CC4F444
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D1EE573_2_00D1EE57
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D0F0393_2_00D0F039
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D0115B3_2_00D0115B
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D0E24E3_2_00D0E24E
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D055BB3_2_00D055BB
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D3555C3_2_00D3555C
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D046063_2_00D04606
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D32BCD3_2_00D32BCD
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_0040575012_2_00405750
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_0041304B12_2_0041304B
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_0040AD4012_2_0040AD40
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_0041291012_2_00412910
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_004132E312_2_004132E3
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_00412F7112_2_00412F71
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00240EE013_2_00240EE0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0026F1B413_2_0026F1B4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0026B18D13_2_0026B18D
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0026F78213_2_0026F782
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002B206C13_2_002B206C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_001FA17013_2_001FA170
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0020029013_2_00200290
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002622C013_2_002622C0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0033243A13_2_0033243A
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0024441013_2_00244410
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0022848013_2_00228480
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0024473013_2_00244730
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0021074613_2_00210746
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002007C013_2_002007C0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0033086413_2_00330864
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0034C89C13_2_0034C89C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002448E013_2_002448E0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0034C95413_2_0034C954
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0027A9F013_2_0027A9F0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00248AC013_2_00248AC0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00332ACB13_2_00332ACB
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00206C7613_2_00206C76
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002E6D0E13_2_002E6D0E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00354EB613_2_00354EB6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00248EC013_2_00248EC0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002BD01413_2_002BD014
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0033313013_2_00333130
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002B11A613_2_002B11A6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0021918013_2_00219180
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0033118913_2_00331189
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0024737013_2_00247370
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_001FF3EC13_2_001FF3EC
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002813D413_2_002813D4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002B949413_2_002B9494
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002794F013_2_002794F0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002094D213_2_002094D2
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002554D013_2_002554D0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002E35F413_2_002E35F4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0023D7D013_2_0023D7D0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002BD98E13_2_002BD98E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_001FDA7813_2_001FDA78
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00333A9D13_2_00333A9D
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0025FB0013_2_0025FB00
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00351B4113_2_00351B41
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0032FBCF13_2_0032FBCF
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0020BC7013_2_0020BC70
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00255D1013_2_00255D10
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00283DE013_2_00283DE0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0028FE3013_2_0028FE30
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0032BFB013_2_0032BFB0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_001FFFC013_2_001FFFC0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002B206C14_2_002B206C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002E6D0E14_2_002E6D0E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_001FA17014_2_001FA170
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0020029014_2_00200290
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002622C014_2_002622C0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0033243A14_2_0033243A
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0024441014_2_00244410
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0022848014_2_00228480
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0024473014_2_00244730
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0021074614_2_00210746
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002007C014_2_002007C0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0033086414_2_00330864
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0034C89C14_2_0034C89C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002448E014_2_002448E0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0034C95414_2_0034C954
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0027A9F014_2_0027A9F0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00248AC014_2_00248AC0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00332ACB14_2_00332ACB
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00206C7614_2_00206C76
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00354EB614_2_00354EB6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00240EE014_2_00240EE0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00248EC014_2_00248EC0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002BD01414_2_002BD014
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0033313014_2_00333130
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002B11A614_2_002B11A6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0026F1B414_2_0026F1B4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0021918014_2_00219180
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0026B18D14_2_0026B18D
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0033118914_2_00331189
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0024737014_2_00247370
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_001FF3EC14_2_001FF3EC
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002813D414_2_002813D4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002B949414_2_002B9494
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002794F014_2_002794F0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002094D214_2_002094D2
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002554D014_2_002554D0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002E35F414_2_002E35F4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0026F78214_2_0026F782
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0023D7D014_2_0023D7D0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002BD98E14_2_002BD98E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_001FDA7814_2_001FDA78
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00333A9D14_2_00333A9D
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0025FB0014_2_0025FB00
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00351B4114_2_00351B41
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0032FBCF14_2_0032FBCF
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0020BC7014_2_0020BC70
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00255D1014_2_00255D10
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00283DE014_2_00283DE0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0028FE3014_2_0028FE30
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0032BFB014_2_0032BFB0
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_001FFFC014_2_001FFFC0
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: String function: 00D39103 appears 91 times
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: String function: 00D213D0 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 00230C44 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 003442D0 appears 114 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 00347CF8 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 0023B9C0 appears 126 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 001F1741 appears 408 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 0023BEC0 appears 269 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 00230AA2 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 00231BBC appears 34 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 0023BE50 appears 78 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 0023C9E0 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 001F3696 appears 124 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 00238B80 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: String function: 0032A840 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: String function: 004026DC appears 38 times
Source: setup.exe.3.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: setup.exe.4.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
Source: installer.exe.7.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows
Source: installer.exe.29.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows
Source: opera_autoupdate.exe.15.drStatic PE information: Number of sections : 13 > 10
Source: Opera_installer_2410291438320976684.dll.16.drStatic PE information: Number of sections : 14 > 10
Source: launcher.exe.7.drStatic PE information: Number of sections : 12 > 10
Source: opera_crashreporter.exe.7.drStatic PE information: Number of sections : 12 > 10
Source: mojo_core.dll.7.drStatic PE information: Number of sections : 11 > 10
Source: opera_autoupdate.exe.7.drStatic PE information: Number of sections : 13 > 10
Source: opera_browser.dll.7.drStatic PE information: Number of sections : 15 > 10
Source: Opera_installer_2410291438317856856.dll.15.drStatic PE information: Number of sections : 14 > 10
Source: notification_helper.exe.7.drStatic PE information: Number of sections : 11 > 10
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTRMatched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon version
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon version
Source: classification engineClassification label: sus34.spyw.evad.winEXE@81/623@0/13
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_00408DD2 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,12_2_00408DD2
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0021051B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,13_2_0021051B
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0021051B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,14_2_0021051B
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_004011FD GetDiskFreeSpaceExW,SendMessageW,12_2_004011FD
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_0040388A _wtol,_wtol,SHGetSpecialFolderPathW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,CoCreateInstance,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,12_2_0040388A
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_00401DF5 GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,12_2_00401DF5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\OperaGXSetup[1].exeJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeMutant created: NULL
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeMutant created: \Sessions\1\BaseNamedObjects\opera_splash_lock_df693e202347b6f1f689bae495ff6ca9
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeMutant created: \Sessions\1\BaseNamedObjects\oauc_registry_mutex
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\Opera/Installer/C:/Users/user/AppData/Local/Programs/Opera GX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeMutant created: \Sessions\1\BaseNamedObjects\Local\ChromeProcessSingletonStartup!
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeFile created: C:\Users\user\AppData\Local\Temp\OperaGXInstallerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCommand line argument: Title3_2_00D1EE57
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCommand line argument: BeginPrompt3_2_00D1EE57
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCommand line argument: Progress3_2_00D1EE57
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCommand line argument: yes3_2_00D1EE57
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCommand line argument: RunProgram3_2_00D1EE57
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCommand line argument: ExecuteFile3_2_00D1EE57
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCommand line argument: InstallPath3_2_00D1EE57
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCommand line argument: %%T3_2_00D1EE57
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeReversingLabs: Detection: 36%
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/move_file_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/unpack_archive_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/service/task_scheduler_v2.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_main.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/common/association_utils.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/change_reg_value_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../base/process/launch_win.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/copy_file_operation.cc
Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_steps.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_folder_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/status/json_installation_status_writer.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_reg_key_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc
Source: assistant_installer.exeString found in binary or memory: post-elevated-install-tasks
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_reg_key_operation.cc
Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/move_file_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/unpack_archive_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/service/task_scheduler_v2.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_main.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/common/association_utils.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/change_reg_value_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../base/process/launch_win.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/copy_file_operation.cc
Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_steps.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_folder_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/status/json_installation_status_writer.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_reg_key_operation.cc
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc
Source: assistant_installer.exeString found in binary or memory: post-elevated-install-tasks
Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_reg_key_operation.cc
Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe "C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeProcess created: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe "C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe" --silent --allusers=0
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --silent --allusers=0 --server-tracking-blob=YzNjYzBkNzBjNDk4NTlkM2U3YTIzOTI2N2M2ZGIyMjU0OGQ2OWMxY2Y5YjZkMTY4MGI3OTJjMTc3ZDI3MGZkMjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInRpbWVzdGFtcCI6IjE3MzAyMTI2MjMuNTk2OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdpbjY0OyB4NjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoib2d4IiwiY29udGVudCI6Im9neGlfMzQ0MjAiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6Ik9GVCJ9LCJ1dWlkIjoiOWVkN2VlMTktY2FmYi00MTZkLTliNzQtMWI1ZGNkMDQwNWZiIn0=
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x32c,0x330,0x334,0x318,0x338,0x6c998c5c,0x6c998c68,0x6c998c74
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe "C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241029103712" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C06000000000000
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x33c,0x340,0x344,0x308,0x318,0x6baf8c5c,0x6baf8c68,0x6baf8c74
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --version
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x3a4f48,0x3a4f58,0x3a4f64
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --backend --initial-pid=3928 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --install-subfolder=114.0.5282.123
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x250,0x254,0x27c,0x258,0x280,0x7ffd94469e20,0x7ffd94469e2c,0x7ffd94469e38
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --bypasslauncher 0
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffd92de1388,0x7ffd92de1398,0x7ffd92de13a8
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x230,0x234,0x238,0x22c,0x208,0x7ff79d2f673c,0x7ff79d2f6748,0x7ff79d2f6758
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized --lowered-browser
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeProcess created: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe "C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe" --silent --allusers=0Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --silent --allusers=0 --server-tracking-blob=YzNjYzBkNzBjNDk4NTlkM2U3YTIzOTI2N2M2ZGIyMjU0OGQ2OWMxY2Y5YjZkMTY4MGI3OTJjMTc3ZDI3MGZkMjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInRpbWVzdGFtcCI6IjE3MzAyMTI2MjMuNTk2OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdpbjY0OyB4NjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoib2d4IiwiY29udGVudCI6Im9neGlfMzQ0MjAiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6Ik9GVCJ9LCJ1dWlkIjoiOWVkN2VlMTktY2FmYi00MTZkLTliNzQtMWI1ZGNkMDQwNWZiIn0=Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x32c,0x330,0x334,0x318,0x338,0x6c998c5c,0x6c998c68,0x6c998c74Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --versionJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe "C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241029103712" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C06000000000000Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --versionJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x33c,0x340,0x344,0x308,0x318,0x6baf8c5c,0x6baf8c68,0x6baf8c74Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --backend --initial-pid=3928 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --install-subfolder=114.0.5282.123Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x3a4f48,0x3a4f58,0x3a4f64Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x250,0x254,0x27c,0x258,0x280,0x7ffd94469e20,0x7ffd94469e2c,0x7ffd94469e38
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized --lowered-browser
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffd92de1388,0x7ffd92de1398,0x7ffd92de13a8
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x230,0x234,0x238,0x22c,0x208,0x7ff79d2f673c,0x7ff79d2f6748,0x7ff79d2f6758
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: cryptnet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: slc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: uiamanager.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: actxprxy.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: twinapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: firewallapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: fwbase.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: fwpolicyiomgr.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeSection loaded: iertutil.dll
Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dll
Source: C:\Windows\explorer.exeSection loaded: twext.dll
Source: C:\Windows\explorer.exeSection loaded: version.dll
Source: C:\Windows\explorer.exeSection loaded: zipfldr.dll
Source: C:\Windows\explorer.exeSection loaded: sendmail.dll
Source: C:\Windows\explorer.exeSection loaded: acppage.dll
Source: C:\Windows\explorer.exeSection loaded: sfc.dll
Source: C:\Windows\explorer.exeSection loaded: msi.dll
Source: C:\Windows\explorer.exeSection loaded: mydocs.dll
Source: C:\Windows\explorer.exeSection loaded: drprov.dll
Source: C:\Windows\explorer.exeSection loaded: ntlanman.dll
Source: C:\Windows\explorer.exeSection loaded: davclnt.dll
Source: C:\Windows\explorer.exeSection loaded: davhlpr.dll
Source: C:\Windows\explorer.exeSection loaded: dlnashext.dll
Source: C:\Windows\explorer.exeSection loaded: playtodevice.dll
Source: C:\Windows\explorer.exeSection loaded: wpdshext.dll
Source: C:\Windows\explorer.exeSection loaded: ehstorapi.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: msvcp140.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dll
Source: C:\Windows\explorer.exeSection loaded: cdprt.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: credui.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: schannel.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: credui.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: uxtheme.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeSection loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: devobj.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: windows.ui.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: netapi32.dll
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
Source: Opera GX Browser .lnk.15.drLNK file: ..\..\..\..\Programs\Opera GX\opera.exe
Source: Opera GX Browser .lnk0.15.drLNK file: ..\AppData\Local\Programs\Opera GX\opera.exe
Source: Opera GX Browser .lnk1.15.drLNK file: ..\..\..\..\Programs\Opera GX\opera.exe
Source: Opera GX Browser .lnk2.15.drLNK file: ..\..\..\..\Programs\Opera GX\opera.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera GX 114.0.5282.123
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: certificate valid
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: assistant_installer.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000D.00000000.2699731841.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000002.2702702953.0000000000385000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\opera.exe.pdb source: opera.exe, 0000001C.00000000.3147832863.00007FF627F7B000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3258373442.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000000.2268937215.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276417846.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000000.2272096796.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000000.2277827487.0000000000738000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000006.00000002.2281279697.0000000000738000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287434715.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000002.3218691525.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000000.2291188941.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227479724.00000000000A8000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215572174.00007FF6E5804000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 0000000F.00000000.3078708913.00007FF6E5804000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000002.3221323048.00007FF6E5804000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081813108.00007FF6E5804000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: browser_assistant.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: EwdhIsAfAL.exe, 00000013.00000000.3134208758.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000015.00000000.3136135528.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000016.00000000.3137495821.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000017.00000000.3138835530.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000018.00000000.3139903179.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 00000019.00000000.3140958934.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 0000001A.00000000.3142098587.000000000011E000.00000002.00000001.01000000.00000016.sdmp, EwdhIsAfAL.exe, 0000001B.00000000.3145686226.000000000011E000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: mojo_core.dll.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698858376.0000000003DA0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Boo\Code\_Offergate\OperaGXInstaller\Build-x64-Release\OperaGXInstaller.pdb source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000000.2164793741.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\opera_autoupdate.exe.pdb source: installer.exe, 0000000F.00000003.3089669286.0000025C726A5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: browser_assistant.exe.pdbe source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003742000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Boo\Code\_Offergate\OperaGXInstaller\Build-x64-Release\OperaGXInstaller.pdb source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000000.2164793741.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmp
Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: assistant_installer.exe.pdb@ source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000D.00000000.2699731841.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000385000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000002.2702702953.0000000000385000.00000002.00000001.01000000.00000011.sdmp
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: dxil.dll.7.drStatic PE information: 0x7DBE8527 [Fri Nov 7 02:32:07 2036 UTC]
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_0040239B LoadLibraryA,GetProcAddress,GetNativeSystemInfo,12_2_0040239B
Source: OperaGXInstaller.exe.0.drStatic PE information: real checksum: 0x3381fe should be: 0x32d8a3
Source: OperaGXSetup[1].exe.0.drStatic PE information: real checksum: 0x3381fe should be: 0x32d8a3
Source: Opera_installer_2410291437108383928.dll.4.drStatic PE information: section name: .rodata
Source: Opera_installer_2410291437108383928.dll.4.drStatic PE information: section name: CPADinfo
Source: Opera_installer_2410291437108383928.dll.4.drStatic PE information: section name: malloc_h
Source: Opera_installer_2410291437111626972.dll.5.drStatic PE information: section name: .rodata
Source: Opera_installer_2410291437111626972.dll.5.drStatic PE information: section name: CPADinfo
Source: Opera_installer_2410291437111626972.dll.5.drStatic PE information: section name: malloc_h
Source: Opera_installer_2410291437117157164.dll.6.drStatic PE information: section name: .rodata
Source: Opera_installer_2410291437117157164.dll.6.drStatic PE information: section name: CPADinfo
Source: Opera_installer_2410291437117157164.dll.6.drStatic PE information: section name: malloc_h
Source: Opera_installer_2410291437126772788.dll.7.drStatic PE information: section name: .rodata
Source: Opera_installer_2410291437126772788.dll.7.drStatic PE information: section name: CPADinfo
Source: Opera_installer_2410291437126772788.dll.7.drStatic PE information: section name: malloc_h
Source: vk_swiftshader.dll.7.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.7.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.7.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.7.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.7.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.7.drStatic PE information: section name: _RDATA
Source: win10_share_handler.dll.7.drStatic PE information: section name: .gxfg
Source: win10_share_handler.dll.7.drStatic PE information: section name: .retplne
Source: win10_share_handler.dll.7.drStatic PE information: section name: _RDATA
Source: win8_importing.dll.7.drStatic PE information: section name: .gxfg
Source: win8_importing.dll.7.drStatic PE information: section name: .retplne
Source: win8_importing.dll.7.drStatic PE information: section name: _RDATA
Source: mojo_core.dll.7.drStatic PE information: section name: .gxfg
Source: mojo_core.dll.7.drStatic PE information: section name: .retplne
Source: mojo_core.dll.7.drStatic PE information: section name: _RDATA
Source: mojo_core.dll.7.drStatic PE information: section name: malloc_h
Source: notification_helper.exe.7.drStatic PE information: section name: .gxfg
Source: notification_helper.exe.7.drStatic PE information: section name: .retplne
Source: notification_helper.exe.7.drStatic PE information: section name: CPADinfo
Source: notification_helper.exe.7.drStatic PE information: section name: _RDATA
Source: opera.exe.7.drStatic PE information: section name: .gxfg
Source: opera.exe.7.drStatic PE information: section name: .retplne
Source: opera.exe.7.drStatic PE information: section name: _RDATA
Source: opera_autoupdate.exe.7.drStatic PE information: section name: .gxfg
Source: opera_autoupdate.exe.7.drStatic PE information: section name: .retplne
Source: opera_autoupdate.exe.7.drStatic PE information: section name: CPADinfo
Source: opera_autoupdate.exe.7.drStatic PE information: section name: LZMADEC
Source: opera_autoupdate.exe.7.drStatic PE information: section name: _RDATA
Source: opera_autoupdate.exe.7.drStatic PE information: section name: malloc_h
Source: opera_browser.dll.7.drStatic PE information: section name: .gxfg
Source: opera_browser.dll.7.drStatic PE information: section name: .retplne
Source: opera_browser.dll.7.drStatic PE information: section name: .rodata
Source: opera_browser.dll.7.drStatic PE information: section name: CPADinfo
Source: opera_browser.dll.7.drStatic PE information: section name: LZMADEC
Source: opera_browser.dll.7.drStatic PE information: section name: _RDATA
Source: opera_browser.dll.7.drStatic PE information: section name: malloc_h
Source: opera_browser.dll.7.drStatic PE information: section name: prot
Source: opera_crashreporter.exe.7.drStatic PE information: section name: .gxfg
Source: opera_crashreporter.exe.7.drStatic PE information: section name: .retplne
Source: opera_crashreporter.exe.7.drStatic PE information: section name: CPADinfo
Source: opera_crashreporter.exe.7.drStatic PE information: section name: _RDATA
Source: opera_crashreporter.exe.7.drStatic PE information: section name: malloc_h
Source: opera_elf.dll.7.drStatic PE information: section name: .gxfg
Source: opera_elf.dll.7.drStatic PE information: section name: .retplne
Source: opera_elf.dll.7.drStatic PE information: section name: _RDATA
Source: opera_gx_splash.exe.7.drStatic PE information: section name: .gxfg
Source: opera_gx_splash.exe.7.drStatic PE information: section name: .retplne
Source: opera_gx_splash.exe.7.drStatic PE information: section name: _RDATA
Source: CUESDK.x64_2017.dll.7.drStatic PE information: section name: .00cfg
Source: dxcompiler.dll.7.drStatic PE information: section name: .gxfg
Source: dxcompiler.dll.7.drStatic PE information: section name: .retplne
Source: dxcompiler.dll.7.drStatic PE information: section name: _RDATA
Source: dxil.dll.7.drStatic PE information: section name: _RDATA
Source: installer.exe.7.drStatic PE information: section name: .gxfg
Source: installer.exe.7.drStatic PE information: section name: .retplne
Source: installer.exe.7.drStatic PE information: section name: _RDATA
Source: installer_helper_64.exe.7.drStatic PE information: section name: .gxfg
Source: installer_helper_64.exe.7.drStatic PE information: section name: .retplne
Source: installer_helper_64.exe.7.drStatic PE information: section name: _RDATA
Source: launcher.exe.7.drStatic PE information: section name: .gxfg
Source: launcher.exe.7.drStatic PE information: section name: .retplne
Source: launcher.exe.7.drStatic PE information: section name: LZMADEC
Source: launcher.exe.7.drStatic PE information: section name: _RDATA
Source: launcher.exe.7.drStatic PE information: section name: malloc_h
Source: libEGL.dll.7.drStatic PE information: section name: .gxfg
Source: libEGL.dll.7.drStatic PE information: section name: .retplne
Source: libEGL.dll.7.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.7.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.7.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.7.drStatic PE information: section name: _RDATA
Source: Opera_installer_241029143713033712.dll.8.drStatic PE information: section name: .rodata
Source: Opera_installer_241029143713033712.dll.8.drStatic PE information: section name: CPADinfo
Source: Opera_installer_241029143713033712.dll.8.drStatic PE information: section name: malloc_h
Source: assistant_installer.exe.12.drStatic PE information: section name: .00cfg
Source: assistant_installer.exe.12.drStatic PE information: section name: .voltbl
Source: assistant_installer.exe.12.drStatic PE information: section name: CPADinfo
Source: browser_assistant.exe.12.drStatic PE information: section name: .00cfg
Source: browser_assistant.exe.12.drStatic PE information: section name: .rodata
Source: browser_assistant.exe.12.drStatic PE information: section name: .voltbl
Source: browser_assistant.exe.12.drStatic PE information: section name: CPADinfo
Source: mojo_core.dll.12.drStatic PE information: section name: .00cfg
Source: mojo_core.dll.12.drStatic PE information: section name: .voltbl
Source: Opera_installer_2410291438317856856.dll.15.drStatic PE information: section name: .gxfg
Source: Opera_installer_2410291438317856856.dll.15.drStatic PE information: section name: .retplne
Source: Opera_installer_2410291438317856856.dll.15.drStatic PE information: section name: .rodata
Source: Opera_installer_2410291438317856856.dll.15.drStatic PE information: section name: CPADinfo
Source: Opera_installer_2410291438317856856.dll.15.drStatic PE information: section name: LZMADEC
Source: Opera_installer_2410291438317856856.dll.15.drStatic PE information: section name: _RDATA
Source: Opera_installer_2410291438317856856.dll.15.drStatic PE information: section name: malloc_h
Source: opera.exe.15.drStatic PE information: section name: .gxfg
Source: opera.exe.15.drStatic PE information: section name: .retplne
Source: opera.exe.15.drStatic PE information: section name: _RDATA
Source: opera_autoupdate.exe.15.drStatic PE information: section name: .gxfg
Source: opera_autoupdate.exe.15.drStatic PE information: section name: .retplne
Source: opera_autoupdate.exe.15.drStatic PE information: section name: CPADinfo
Source: opera_autoupdate.exe.15.drStatic PE information: section name: LZMADEC
Source: opera_autoupdate.exe.15.drStatic PE information: section name: _RDATA
Source: opera_autoupdate.exe.15.drStatic PE information: section name: malloc_h
Source: Opera_installer_2410291438320976684.dll.16.drStatic PE information: section name: .gxfg
Source: Opera_installer_2410291438320976684.dll.16.drStatic PE information: section name: .retplne
Source: Opera_installer_2410291438320976684.dll.16.drStatic PE information: section name: .rodata
Source: Opera_installer_2410291438320976684.dll.16.drStatic PE information: section name: CPADinfo
Source: Opera_installer_2410291438320976684.dll.16.drStatic PE information: section name: LZMADEC
Source: Opera_installer_2410291438320976684.dll.16.drStatic PE information: section name: _RDATA
Source: Opera_installer_2410291438320976684.dll.16.drStatic PE information: section name: malloc_h
Source: installer.exe.29.drStatic PE information: section name: .gxfg
Source: installer.exe.29.drStatic PE information: section name: .retplne
Source: installer.exe.29.drStatic PE information: section name: _RDATA
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D390E0 push ecx; ret 3_2_00D390F3
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D396C8 push ecx; ret 3_2_00D396DD
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_00412C00 push eax; ret 12_2_00412C2E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0032B10C push ecx; ret 13_2_0032B11F
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0032B10C push ecx; ret 14_2_0032B11F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC42FA0 SHGetFolderPathW,SHCreateDirectoryExW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,URLDownloadToFileW,ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,0_2_00007FF73CC42FA0
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\libGLESv2.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeFile created: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_browser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exe.1730212712.old (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\dxcompiler.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Opera_GX_114.0.5282.123_Autoupdate_x64[1].exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeFile created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291438320976684.dllJump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\OperaGXSetup[1].exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437111626972.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\win10_share_handler.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\CUESDK.x64_2017.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.exe.1730212712.old (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291438317856856.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\52FCEE075297\installer.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437126772788.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer_helper_64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_241029143713033712.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\win8_importing.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\mojo_core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_gx_splash.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437117157164.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\Opera_GX_assistant_73.0.3856.382_Setup[1].exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\browser_assistant.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\assistant_packageJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\mojo_core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437108383928.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\additional_file0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\opera_packageJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\dxil.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\opera_packageJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\assistant_packageJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103711306.logJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103713177.logJump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeFile created: C:\Users\user\AppData\Local\Temp\assistant_installer_20241029103753.logJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103832254.log
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Opera GX Stable
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Opera GX Stable
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Taskband FavoritesResolve
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0025A6D0 rdtsc 13_2_0025A6D0
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_browser.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exe.1730212712.old (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\dxcompiler.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Opera_GX_114.0.5282.123_Autoupdate_x64[1].exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291438320976684.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437111626972.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\win10_share_handler.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\CUESDK.x64_2017.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291438317856856.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437126772788.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer_helper_64.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_241029143713033712.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\win8_importing.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\mojo_core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_gx_splash.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437117157164.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\browser_assistant.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\assistant_packageJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\mojo_core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437108383928.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\opera_packageJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\dxil.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeEvaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_13-68508
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeAPI coverage: 7.0 %
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeAPI coverage: 5.8 %
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe TID: 1136Thread sleep count: 167 > 30
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe TID: 5092Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\7zSC91E97EB FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\7zSC91E97EB FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\7zSC91E97EB FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\wasm FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\blob_storage\9d76c84c-76ce-46b2-856a-88905fd04d0c FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable FullSizeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC59394 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF73CC59394
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D08D20 FindFirstFileW,3_2_00D08D20
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D2FEEB FindFirstFileExW,3_2_00D2FEEB
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_004033B3 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,12_2_004033B3
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_00402F12 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,12_2_00402F12
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00259120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,13_2_00259120
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002E9AE2 FindFirstFileExW,13_2_002E9AE2
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00259120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,14_2_00259120
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002E9AE2 FindFirstFileExW,14_2_002E9AE2
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D0A419 GetSystemInfo,3_2_00D0A419
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Local\Programs\Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437126772788.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\doneJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: explorer.exe, 00000012.00000000.3107242903.000000000962B000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: explorer.exe, 00000012.00000000.3107242903.00000000097F3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWws
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEC9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000012.00000000.3107242903.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2261697080.000002269FE5B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FE5B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWoi
Source: explorer.exe, 00000012.00000000.3107242903.0000000009605000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTVMWare
Source: explorer.exe, 00000012.00000000.3093360758.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2261697080.000002269FEC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000002.2261697080.000002269FE77000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FEC9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250266492.000002269FE77000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FE77000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FEC9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000EDB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F74000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: explorer.exe, 00000012.00000000.3093360758.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000012.00000000.3107242903.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: explorer.exe, 00000012.00000000.3093360758.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000012.00000000.3093360758.0000000000D99000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000012.00000000.3107242903.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information queried: ProcessInformation
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0025A6D0 rdtsc 13_2_0025A6D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC47E58 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF73CC47E58
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_0040239B LoadLibraryA,GetProcAddress,GetNativeSystemInfo,12_2_0040239B
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_003497FB mov eax, dword ptr fs:[00000030h]13_2_003497FB
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00337C65 mov eax, dword ptr fs:[00000030h]13_2_00337C65
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_003497FB mov eax, dword ptr fs:[00000030h]14_2_003497FB
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00337C65 mov eax, dword ptr fs:[00000030h]14_2_00337C65
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC5A5A4 GetProcessHeap,0_2_00007FF73CC5A5A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC47E58 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF73CC47E58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC48038 SetUnhandledExceptionFilter,0_2_00007FF73CC48038
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC4EA40 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF73CC4EA40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC47B7C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF73CC47B7C
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D2162A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00D2162A
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D267CB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00D267CB
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D217B7 SetUnhandledExceptionFilter,3_2_00D217B7
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D20D2C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00D20D2C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0026AD1E GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,CreateThread,13_2_0026AD1E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002B206C SetUnhandledExceptionFilter,SetConsoleCtrlHandler,_strlen,_strlen,_strlen,_strlen,_strlen,SetUnhandledExceptionFilter,_strlen,_strlen,SetProcessShutdownParameters,__Init_thread_header,__Init_thread_footer,_strlen,13_2_002B206C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0026C3B6 GetCurrentProcessId,SetUnhandledExceptionFilter,13_2_0026C3B6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0032A428 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,13_2_0032A428
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0026ACEE GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,CreateThread,13_2_0026ACEE
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00201C00 SetUnhandledExceptionFilter,13_2_00201C00
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0033BE76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_0033BE76
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_002B206C SetUnhandledExceptionFilter,SetConsoleCtrlHandler,_strlen,_strlen,_strlen,_strlen,_strlen,SetUnhandledExceptionFilter,_strlen,_strlen,SetProcessShutdownParameters,__Init_thread_header,__Init_thread_footer,_strlen,14_2_002B206C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0026C3B6 GetCurrentProcessId,SetUnhandledExceptionFilter,14_2_0026C3B6
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0032A428 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,14_2_0032A428
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0026AD1E GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,CreateThread,14_2_0026AD1E
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_00201C00 SetUnhandledExceptionFilter,14_2_00201C00
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 14_2_0033BE76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,14_2_0033BE76

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtOpenSection: Direct from: 0x77382E0C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtQueryVolumeInformationFile: Direct from: 0x77382F2C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtMapViewOfSection: Direct from: 0x77382D1C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtReadVirtualMemory: Direct from: 0x77382E8C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtProtectVirtualMemory: Direct from: 0x77382F9C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtClose: Direct from: 0x77382B6C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtUnmapViewOfSection: Direct from: 0x77382D3C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtCreateMutant: Direct from: 0x773835CC
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtQueryAttributesFile: Direct from: 0x77382E6C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtSetInformationProcess: Direct from: 0x77382C5C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtQueryInformationProcess: Direct from: 0x77382C26
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtSetInformationThread: Direct from: 0x77382ECC
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtOpenKeyEx: Direct from: 0x77382B9C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtOpenKeyEx: Direct from: 0x77383C9C
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtQueryValueKey: Direct from: 0x77382BEC
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtDeviceIoControlFile: Direct from: 0x77382AEC
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtAllocateVirtualMemory: Direct from: 0x77382BFC
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtCreateFile: Direct from: 0x77382FEC
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtOpenFile: Direct from: 0x77382DCC
Source: C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exeNtAddAtomEx: Direct from: 0x7738312C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeProcess created: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe "C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe" --silent --allusers=0Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x32c,0x330,0x334,0x318,0x338,0x6c998c5c,0x6c998c68,0x6c998c74Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe "C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241029103712" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C06000000000000Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --versionJump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x33c,0x340,0x344,0x308,0x318,0x6baf8c5c,0x6baf8c68,0x6baf8c74Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x3a4f48,0x3a4f58,0x3a4f64Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x250,0x254,0x27c,0x258,0x280,0x7ffd94469e20,0x7ffd94469e2c,0x7ffd94469e38
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffd92de1388,0x7ffd92de1398,0x7ffd92de13a8
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x230,0x234,0x238,0x22c,0x208,0x7ff79d2f673c,0x7ff79d2f6748,0x7ff79d2f6758
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeFile opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe c:\users\user\appdata\local\temp\7zsc91e97eb\setup.exe --silent --allusers=0 --server-tracking-blob=yznjyzbknzbjndk4ntlkm2u3ytizoti2n2m2zgiymju0ogq2owmxy2y5yjzkmty4mgi3otjjmtc3zdi3mgzkmjp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qioijvcgvyyv9necisinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0ylz91dg1fc291cmnlpu9gvcz1dg1fbwvkaxvtpxbijnv0bv9jyw1wywlnbj1vz3gmdxrtx2nvbnrlbnq9b2d4av8zndqymcisinrpbwvzdgftcci6ije3mzaymti2mjmuntk2ocisinvzzxjhz2vudci6ik1vemlsbgevnc4wichjb21wyxrpymxloybnu0lfidcumdsgv2luzg93cybovca2lji7ifdpbjy0oyb4njq7ifryawrlbnqvny4woyautkvunc4wqzsglk5fvdqumeu7ic5orvqgq0xsidiumc41mdcynzsglk5fvcbdtfigmy4wljmwnzi5oyautkvuienmuiazljuumza3mjkpiiwidxrtijp7imnhbxbhawduijoib2d4iiwiy29udgvudci6im9neglfmzq0mjailcjtzwrpdw0ioijwyiisinnvdxjjzsi6ik9gvcj9lcj1dwlkijoiowvkn2vlmtkty2fmyi00mtzkltlinzqtmwi1zgnkmdqwnwziin0=
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe c:\users\user\appdata\local\temp\7zsc91e97eb\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x32c,0x330,0x334,0x318,0x338,0x6c998c5c,0x6c998c68,0x6c998c74
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe "c:\users\user\appdata\local\temp\7zsc91e97eb\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_20241029103712" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=nta0mmfkmjjhotrhyti0mtzkowu1nmnhmtjizwq1nwvhntuyzjhhzgmwmduyymm1zgqzzji4ndnjmzqwnmfjntp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0ylz91dg1fc291cmnlpu9gvcz1dg1fbwvkaxvtpxbijnv0bv9jyw1wywlnbj1vz3gmdxrtx2nvbnrlbnq9b2d4av8zndqymcisinn5c3rlbsi6eyjwbgf0zm9ybsi6eyjhcmnoijoiedg2xzy0iiwib3bzexmioijxaw5kb3dziiwib3bzexmtdmvyc2lvbii6ijewiiwicgfja2fnzsi6ikvyrsj9fswidgltzxn0yw1wijoimtczmdixmjyymy41oty4iiwidxnlcmfnzw50ijoitw96awxsys80ljagkgnvbxbhdglibgu7ie1tsuugny4woybxaw5kb3dzie5uidyumjsgv2lunjq7ihg2ndsgvhjpzgvudc83lja7ic5orvq0ljbdoyautkvunc4wrtsglk5fvcbdtfigmi4wljuwnzi3oyautkvuienmuiazljaumza3mjk7ic5orvqgq0xsidmuns4zmdcyoskilcj1dg0ionsiy2ftcgfpz24ioijvz3gilcjjb250zw50ijoib2d4av8zndqymcisim1lzgl1bsi6inbiiiwic291cmnlijoit0zuin0sinv1awqioii5zwq3zwuxos1jywziltqxnmqtowi3nc0xyjvky2qwnda1zmiifq== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2c06000000000000
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe c:\users\user\appdata\local\temp\7zsc91e97eb\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x33c,0x340,0x344,0x308,0x318,0x6baf8c5c,0x6baf8c68,0x6baf8c74
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe "c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_202410291037121\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x3a4f48,0x3a4f58,0x3a4f64
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.123\installer.exe" --backend --initial-pid=3928 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_202410291037121" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=nta0mmfkmjjhotrhyti0mtzkowu1nmnhmtjizwq1nwvhntuyzjhhzgmwmduyymm1zgqzzji4ndnjmzqwnmfjntp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0ylz91dg1fc291cmnlpu9gvcz1dg1fbwvkaxvtpxbijnv0bv9jyw1wywlnbj1vz3gmdxrtx2nvbnrlbnq9b2d4av8zndqymcisinn5c3rlbsi6eyjwbgf0zm9ybsi6eyjhcmnoijoiedg2xzy0iiwib3bzexmioijxaw5kb3dziiwib3bzexmtdmvyc2lvbii6ijewiiwicgfja2fnzsi6ikvyrsj9fswidgltzxn0yw1wijoimtczmdixmjyymy41oty4iiwidxnlcmfnzw50ijoitw96awxsys80ljagkgnvbxbhdglibgu7ie1tsuugny4woybxaw5kb3dzie5uidyumjsgv2lunjq7ihg2ndsgvhjpzgvudc83lja7ic5orvq0ljbdoyautkvunc4wrtsglk5fvcbdtfigmi4wljuwnzi3oyautkvuienmuiazljaumza3mjk7ic5orvqgq0xsidmuns4zmdcyoskilcj1dg0ionsiy2ftcgfpz24ioijvz3gilcjjb250zw50ijoib2d4av8zndqymcisim1lzgl1bsi6inbiiiwic291cmnlijoit0zuin0sinv1awqioii5zwq3zwuxos1jywziltqxnmqtowi3nc0xyjvky2qwnda1zmiifq== --silent --desktopshortcut=1 --install-subfolder=114.0.5282.123
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.123\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x250,0x254,0x27c,0x258,0x280,0x7ffd94469e20,0x7ffd94469e2c,0x7ffd94469e38
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.123\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffd92de1388,0x7ffd92de1398,0x7ffd92de13a8
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "c:\users\user\appdata\local\programs\opera gx\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x230,0x234,0x238,0x22c,0x208,0x7ff79d2f673c,0x7ff79d2f6748,0x7ff79d2f6758
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe c:\users\user\appdata\local\temp\7zsc91e97eb\setup.exe --silent --allusers=0 --server-tracking-blob=yznjyzbknzbjndk4ntlkm2u3ytizoti2n2m2zgiymju0ogq2owmxy2y5yjzkmty4mgi3otjjmtc3zdi3mgzkmjp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qioijvcgvyyv9necisinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0ylz91dg1fc291cmnlpu9gvcz1dg1fbwvkaxvtpxbijnv0bv9jyw1wywlnbj1vz3gmdxrtx2nvbnrlbnq9b2d4av8zndqymcisinrpbwvzdgftcci6ije3mzaymti2mjmuntk2ocisinvzzxjhz2vudci6ik1vemlsbgevnc4wichjb21wyxrpymxloybnu0lfidcumdsgv2luzg93cybovca2lji7ifdpbjy0oyb4njq7ifryawrlbnqvny4woyautkvunc4wqzsglk5fvdqumeu7ic5orvqgq0xsidiumc41mdcynzsglk5fvcbdtfigmy4wljmwnzi5oyautkvuienmuiazljuumza3mjkpiiwidxrtijp7imnhbxbhawduijoib2d4iiwiy29udgvudci6im9neglfmzq0mjailcjtzwrpdw0ioijwyiisinnvdxjjzsi6ik9gvcj9lcj1dwlkijoiowvkn2vlmtkty2fmyi00mtzkltlinzqtmwi1zgnkmdqwnwziin0=Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe c:\users\user\appdata\local\temp\7zsc91e97eb\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x32c,0x330,0x334,0x318,0x338,0x6c998c5c,0x6c998c68,0x6c998c74Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe "c:\users\user\appdata\local\temp\7zsc91e97eb\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_20241029103712" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=nta0mmfkmjjhotrhyti0mtzkowu1nmnhmtjizwq1nwvhntuyzjhhzgmwmduyymm1zgqzzji4ndnjmzqwnmfjntp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0ylz91dg1fc291cmnlpu9gvcz1dg1fbwvkaxvtpxbijnv0bv9jyw1wywlnbj1vz3gmdxrtx2nvbnrlbnq9b2d4av8zndqymcisinn5c3rlbsi6eyjwbgf0zm9ybsi6eyjhcmnoijoiedg2xzy0iiwib3bzexmioijxaw5kb3dziiwib3bzexmtdmvyc2lvbii6ijewiiwicgfja2fnzsi6ikvyrsj9fswidgltzxn0yw1wijoimtczmdixmjyymy41oty4iiwidxnlcmfnzw50ijoitw96awxsys80ljagkgnvbxbhdglibgu7ie1tsuugny4woybxaw5kb3dzie5uidyumjsgv2lunjq7ihg2ndsgvhjpzgvudc83lja7ic5orvq0ljbdoyautkvunc4wrtsglk5fvcbdtfigmi4wljuwnzi3oyautkvuienmuiazljaumza3mjk7ic5orvqgq0xsidmuns4zmdcyoskilcj1dg0ionsiy2ftcgfpz24ioijvz3gilcjjb250zw50ijoib2d4av8zndqymcisim1lzgl1bsi6inbiiiwic291cmnlijoit0zuin0sinv1awqioii5zwq3zwuxos1jywziltqxnmqtowi3nc0xyjvky2qwnda1zmiifq== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2c06000000000000Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe c:\users\user\appdata\local\temp\7zsc91e97eb\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x33c,0x340,0x344,0x308,0x318,0x6baf8c5c,0x6baf8c68,0x6baf8c74Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.123\installer.exe" --backend --initial-pid=3928 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_202410291037121" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=nta0mmfkmjjhotrhyti0mtzkowu1nmnhmtjizwq1nwvhntuyzjhhzgmwmduyymm1zgqzzji4ndnjmzqwnmfjntp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0ylz91dg1fc291cmnlpu9gvcz1dg1fbwvkaxvtpxbijnv0bv9jyw1wywlnbj1vz3gmdxrtx2nvbnrlbnq9b2d4av8zndqymcisinn5c3rlbsi6eyjwbgf0zm9ybsi6eyjhcmnoijoiedg2xzy0iiwib3bzexmioijxaw5kb3dziiwib3bzexmtdmvyc2lvbii6ijewiiwicgfja2fnzsi6ikvyrsj9fswidgltzxn0yw1wijoimtczmdixmjyymy41oty4iiwidxnlcmfnzw50ijoitw96awxsys80ljagkgnvbxbhdglibgu7ie1tsuugny4woybxaw5kb3dzie5uidyumjsgv2lunjq7ihg2ndsgvhjpzgvudc83lja7ic5orvq0ljbdoyautkvunc4wrtsglk5fvcbdtfigmi4wljuwnzi3oyautkvuienmuiazljaumza3mjk7ic5orvqgq0xsidmuns4zmdcyoskilcj1dg0ionsiy2ftcgfpz24ioijvz3gilcjjb250zw50ijoib2d4av8zndqymcisim1lzgl1bsi6inbiiiwic291cmnlijoit0zuin0sinv1awqioii5zwq3zwuxos1jywziltqxnmqtowi3nc0xyjvky2qwnda1zmiifq== --silent --desktopshortcut=1 --install-subfolder=114.0.5282.123Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe "c:\users\user\appdata\local\temp\.opera\opera gx installer temp\opera_package_202410291037121\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x3a4f48,0x3a4f58,0x3a4f64Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.123\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x250,0x254,0x27c,0x258,0x280,0x7ffd94469e20,0x7ffd94469e2c,0x7ffd94469e38
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.123\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffd92de1388,0x7ffd92de1398,0x7ffd92de13a8
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "c:\users\user\appdata\local\programs\opera gx\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.123 --initial-client-data=0x230,0x234,0x238,0x22c,0x208,0x7ff79d2f673c,0x7ff79d2f6748,0x7ff79d2f6758
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 12_2_0040247A AllocateAndInitializeSid,CheckTokenMembership,FreeSid,12_2_0040247A
Source: installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpBinary or memory string: Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.Could not activate the menu item.ProgmanSysListView324
Source: explorer.exe, 00000012.00000000.3094100142.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, EwdhIsAfAL.exe, 00000013.00000000.3134850842.0000000001CB0000.00000002.00000001.00040000.00000000.sdmp, EwdhIsAfAL.exe, 00000015.00000000.3136665592.0000000001350000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: IProgram Manager
Source: installer.exe, 0000000F.00000002.3214070707.0000025C72783000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
Source: explorer.exe, 00000012.00000000.3094100142.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.3095955968.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, EwdhIsAfAL.exe, 00000013.00000000.3134850842.0000000001CB0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: installer.exe, 0000000F.00000003.3162070181.0000025C70E27000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000002.3213721682.0000025C70E27000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.3094100142.00000000013A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: installer.exe, 0000000F.00000003.3162070181.0000025C70E27000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 0000000F.00000002.3213721682.0000025C70E27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd%
Source: explorer.exe, 00000012.00000000.3093360758.0000000000D69000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: +Progman
Source: OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: installer.exe, 0000000F.00000002.3213958117.0000025C72690000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager_1*&
Source: explorer.exe, 00000012.00000000.3094100142.00000000013A0000.00000002.00000001.00040000.00000000.sdmp, EwdhIsAfAL.exe, 00000013.00000000.3134850842.0000000001CB0000.00000002.00000001.00040000.00000000.sdmp, EwdhIsAfAL.exe, 00000015.00000000.3136665592.0000000001350000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: explorer.exe, 00000012.00000000.3107242903.00000000098AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd31A
Source: installer.exe, 0000000F.00000002.3213558547.0000025C70D96000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager}#?
Source: installer.exe, 0000000F.00000003.3162070181.0000025C70E27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progmanell
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC608D0 cpuid 0_2_00007FF73CC608D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,0_2_00007FF73CC5CDCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: EnumSystemLocalesW,0_2_00007FF73CC55D2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: EnumSystemLocalesW,0_2_00007FF73CC5CD34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: GetLocaleInfoW,0_2_00007FF73CC5D014
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,0_2_00007FF73CC5C908
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: GetLocaleInfoW,0_2_00007FF73CC5607C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_00007FF73CC5D16C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: GetLocaleInfoW,0_2_00007FF73CC5D21C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,0_2_00007FF73CC5D350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: EnumSystemLocalesW,0_2_00007FF73CC5CC64
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: GetACP,IsValidCodePage,GetLocaleInfoW,3_2_00D33117
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: EnumSystemLocalesW,3_2_00D333C3
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: GetLocaleInfoEx,FormatMessageA,3_2_00D2239E
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: EnumSystemLocalesW,3_2_00D334A9
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: EnumSystemLocalesW,3_2_00D3340E
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,3_2_00D33534
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: GetLocaleInfoW,3_2_00D33787
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,3_2_00D338B0
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: GetLocaleInfoW,3_2_00D339B6
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,3_2_00D33A8C
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: EnumSystemLocalesW,3_2_00D2CA14
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: GetLocaleInfoW,3_2_00D2CF23
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,12_2_004021B3
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: GetLocaleInfoW,13_2_0034769C
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: GetLocaleInfoW,14_2_0034769C
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeQueries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\installer_prefs_include.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\root_files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\files_list VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\pref_default_overrides VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\installer_prefs_include.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\custom_partner_content.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\doh_providers.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.version VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.version VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\pref_default_overrides VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\ab_tests.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Medium.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Medium.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\custom_partner_content.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\pref_default_overrides VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\013E742B-287B-4228-A0B9-BD617E4E02A4.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\07593226-C5C5-438B-86BE-3F6361CD5B10.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\0CD5F3A0-8BF6-11E2-9E96-0800200C9A66.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\1AF2CDD0-8BF3-11E2-9E96-0800200C9A66.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\1CF37043-6733-479C-9086-7B21A2292DDA.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\2A3F5C20-8BF5-11E2-9E96-0800200C9A66.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\2F8F0E41-F521-45A4-9691-F664AFAFE67F.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\3B6191A0-8BF3-11E2-9E96-0800200C9A66.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\3BFDFA54-5DD6-4DFF-8B6C-C1715F306D6B.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\4C95ADC1-5FD9-449D-BC75-77CA217403AE.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\5BBBDD5B-EDC7-4168-9F5D-290AF826E716.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\66DD4BB6-A3BA-4B11-AF7A-F4BF23E073B2.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\6D3582E1-6013-429F-BB34-C75B90CDD1F8.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\76C397A8-9E8E-4706-8203-BD2878E9C618.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\8D754F20-8BF5-11E2-9E96-0800200C9A66.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\AD2FD2BD-0727-4AF7-8917-AAED8627ED47.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\B478FE0C-0761-41C3-946F-CD1340356039.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\C665D993-1B49-4C2E-962C-BEB19993BB86.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\CFCE84E5-9A95-4B3F-B8E4-3E98CF7EE6C5.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\CFD4BE41-4C6D-496A-ADDB-4095DFA1DD0E.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\F3F34CBB-24FF-4830-9E87-1663E7A0A5EE.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\F98D4D4C-8AA7-4619-A1E7-AC89B24558DD.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\FF57F01A-0718-44B7-8A1F-8B15BC33A50B.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\FFF3F819-B6CE-4DE6-B4E4-8E2618ABC0D9.ico VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\video_conference_popout.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\continue_shopping.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\domain_suggestions.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\MEIPreload\manifest.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\browser.js VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\siteprefs.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\partner_speeddials.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\daily_wallpapers.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ThinItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ThinItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Underwave-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Web\Wallpaper\Windows\img0.jpg VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Medium.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ThinItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Underwave-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Underwave-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Medium.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Medium.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Underwave-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Medium.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Medium.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Underwave-Bold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.version VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ThinItalic.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\MEIPreload\preloaded_data.pb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_002ACB18 GetVersion,CreateNamedPipeW,13_2_002ACB18
Source: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exeCode function: 0_2_00007FF73CC480A4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF73CC480A4
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_00210746 GetUserNameW,GetNamedSecurityInfoW,GetNamedSecurityInfoW,GetExplicitEntriesFromAclW,CheckTokenMembership,BuildExplicitAccessWithNameW,SetEntriesInAclW,SetEntriesInAclW,LocalFree,LocalFree,LocalFree,LocalFree,SetNamedSecurityInfoW,SetNamedSecurityInfoW,LocalFree,LocalFree,13_2_00210746
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exeCode function: 13_2_0033F7E2 GetTimeZoneInformation,13_2_0033F7E2
Source: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exeCode function: 3_2_00D01C57 GetVersion,GetModuleHandleW,GetProcAddress,GetSystemDirectoryW,LoadLibraryExW,3_2_00D01C57
Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 BlobJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
1
Software		Acquire Infrastructure1
Valid Accounts		31
Windows Management Instrumentation		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		2
Disable or Modify Tools		1
Credential API Hooking		2
System Time Discovery		Remote Services11
Archive Collected Data		21
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts3
Native API		1
DLL Search Order Hijacking		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		11
Input Capture		1
Account Discovery		Remote Desktop Protocol1
Credential API Hooking		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts13
Command and Scripting Interpreter		1
Valid Accounts		1
DLL Search Order Hijacking		1
Abuse Elevation Control Mechanism		Security Account Manager3
File and Directory Discovery		SMB/Windows Admin Shares11
Input Capture		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron1
Windows Service		1
Valid Accounts		2
Obfuscated Files or Information		NTDS88
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd1
Registry Run Keys / Startup Folder		11
Access Token Manipulation		1
Timestomp		LSA Secrets1
Query Registry		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
Windows Service		1
DLL Side-Loading		Cached Domain Credentials51
Security Software Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items13
Process Injection		1
DLL Search Order Hijacking		DCSync2
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/Job1
Registry Run Keys / Startup Folder		11
Masquerading		Proc Filesystem41
Virtualization/Sandbox Evasion		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
Valid Accounts		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
Modify Registry		Network Sniffing1
Remote System Discovery		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd41
Virtualization/Sandbox Evasion		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task11
Access Token Manipulation		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers13
Process Injection		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1544572 Sample: SecuriteInfo.com.Adware.Ele... Startdate: 29/10/2024 Architecture: WINDOWS Score: 34 118 Malicious sample detected (through community Yara rule) 2->118 120 Multi AV Scanner detection for submitted file 2->120 122 Contains functionality to register a low level keyboard hook 2->122 11 SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe 16 2->11         started        15 opera_autoupdate.exe 2->15         started        process3 dnsIp4 112 185.26.182.112 NO-OPERANO Norway 11->112 98 C:\Users\user\...\OperaGXInstaller.exe, PE32 11->98 dropped 100 C:\Users\user\AppData\...\OperaGXSetup[1].exe, PE32 11->100 dropped 17 OperaGXInstaller.exe 2 11->17         started        114 82.145.216.20 NO-OPERANO United Kingdom 15->114 116 127.0.0.1 unknown unknown 15->116 102 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 15->102 dropped 20 opera_autoupdate.exe 15->20         started        file5 process6 file7 60 C:\Users\user\AppData\Local\...\setup.exe, PE32 17->60 dropped 22 setup.exe 50 17->22         started        process8 dnsIp9 106 185.26.182.111 NO-OPERANO Norway 22->106 108 185.26.182.122 NO-OPERANO Norway 22->108 110 7 other IPs or domains 22->110 72 Opera_GX_assistant....exe_sfx.exe (copy), PE32 22->72 dropped 74 Opera_installer_2410291437108383928.dll, PE32 22->74 dropped 76 C:\Users\user\AppData\Local\...\setup.exe, PE32 22->76 dropped 78 4 other files (none is malicious) 22->78 dropped 26 setup.exe 1 178 22->26         started        29 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 5 22->29         started        31 setup.exe 5 22->31         started        33 2 other processes 22->33 file10 process11 file12 80 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 26->80 dropped 82 Opera_installer_2410291437126772788.dll, PE32 26->82 dropped 84 C:\Users\user\AppData\...\win8_importing.dll, PE32+ 26->84 dropped 96 20 other files (none is malicious) 26->96 dropped 35 installer.exe 26->35         started        39 setup.exe 4 26->39         started        86 C:\Users\user\AppData\Local\...\mojo_core.dll, PE32 29->86 dropped 88 C:\Users\user\...\browser_assistant.exe, PE32 29->88 dropped 90 C:\Users\user\...\assistant_installer.exe, PE32 29->90 dropped 92 Opera_installer_2410291437111626972.dll, PE32 31->92 dropped 94 Opera_installer_2410291437117157164.dll, PE32 33->94 dropped 41 assistant_installer.exe 2 33->41         started        process13 file14 62 Opera_installer_2410291438317856856.dll, PE32+ 35->62 dropped 64 C:\Users\user\AppData\Local\...\opera.exe, PE32+ 35->64 dropped 66 C:\Users\user\...\opera_autoupdate.exe, PE32+ 35->66 dropped 70 2 other files (none is malicious) 35->70 dropped 124 Installs a global event hook (focus changed) 35->124 43 EwdhIsAfAL.exe 35->43 injected 46 explorer.exe 35->46 injected 48 installer.exe 35->48         started        51 15 other processes 35->51 68 C:\...\Opera_installer_241029143713033712.dll, PE32 39->68 dropped signatures15 process16 file17 126 Found direct / indirect Syscall (likely to bypass EDR) 43->126 53 opera.exe 46->53         started        58 Opera_installer_2410291438320976684.dll, PE32+ 48->58 dropped 56 opera_crashreporter.exe 51->56         started        signatures18 process19 dnsIp20 104 192.168.2.6 unknown unknown 53->104

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe37%ReversingLabsWin64.Trojan.Generic

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\Opera_GX_assistant_73.0.3856.382_Setup[1].exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\CUESDK.x64_2017.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\assistant_package0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\dxcompiler.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\dxil.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer_helper_64.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exe.1730212712.old (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\mojo_core.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\notification_helper.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.exe.1730212712.old (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_browser.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_elf.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_gx_splash.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vulkan-1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\win10_share_handler.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\win8_importing.dll0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe0%ReversingLabs
C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\52FCEE075297\installer.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\additional_file0.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\browser_assistant.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\mojo_core.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437108383928.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437111626972.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437117157164.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437126772788.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_241029143713033712.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2410291438317856856.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\Opera_installer_2410291438320976684.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV0%URL Reputationsafe
https://api.msn.com:443/v1/news/Feed/Windows?0%URL Reputationsafe
https://completion.amazon.com/search/complete?q=0%URL Reputationsafe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings0%URL Reputationsafe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp0%URL Reputationsafe
http://www.unicode.org/copyright.html0%URL Reputationsafe
http://schemas.micro0%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://yandex.ua/search/?clid=2358536&text=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
    		unknown
    https://legal.opera.com/termsOperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
      		unknown
      https://www.deezer.com/sr/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
        		unknown
        https://api.browser.yandex.ua/suggest/get?part=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
          		unknown
          https://desktop-netinstaller-sub.osp.opera.software/tsetup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmpfalse
            		unknown
            https://autoupdate.opera.com/me/msetup.exe, 00000004.00000002.3261130813.0000000000EDB000.00000004.00000020.00020000.00000000.sdmpfalse
              		unknown
              https://download5.operacdn.com/ftp/pub/opera_gx/114.0.5282.123/win/Opera_GX_114.0.5282.123_Autoupdatsetup.exe, 00000004.00000003.2732108738.0000000004899000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DVexplorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://www.so.com/favicon.icocss/searchstyle_360.cssimages/logo_360.pnginstaller.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmpfalse
                  		unknown
                  https://desktop-netinstaller-sub.osp.opera.software/psetup.exe, 00000004.00000003.2620394310.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    https://help.opera.com/latest/OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                      		unknown
                      https://api.msn.com:443/v1/news/Feed/Windows?explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.3107242903.000000000973C000.00000004.00000001.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=af8f1523-0107-4b83-93setup.exe, 00000004.00000003.2325593647.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2620394310.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2314345754.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517760672.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2314473101.0000000000FA4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F74000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        https://download.opera.com/rsetup.exe, 00000004.00000002.3261130813.0000000000EDB000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          https://word.office.comMexplorer.exe, 00000012.00000000.3110957749.000000000C048000.00000004.00000001.00020000.00000000.sdmpfalse
                            		unknown
                            https://policies.google.com/terms;OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                              		unknown
                              https://www.baidu.com/favicon.icoinstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                		unknown
                                https://ff.search.yahoo.com/gossip?output=fxjson&command=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://features.opera-api2.com/9setup.exe, 00000004.00000003.2314133238.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325593647.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://localhost:3001api/prefs/?product=$1&version=$2..OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                      		unknown
                                      http://www.opera.comsetup.exe, 00000004.00000003.3252788304.0000000004899000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3271500365.000000000489C000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2621165504.000000003F94C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3236954058.000000003F974000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732108738.0000000004899000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newOperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.0000000003301000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                          		unknown
                                          https://www.deezer.com/no/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://www.deezer.com/ro/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://completion.amazon.com/search/complete?q=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://listen.tidal.com/installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://desktop-netinstaller-sub.osp.opera.software/Tsetup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://download.opera.com/Zsetup.exe, 00000004.00000002.3261130813.0000000000EDB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://desktop-netinstaller-sub.osp.opera.software/wWsetup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://desktop-netinstaller-sub.osp.opera.software/Psetup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://desktop-netinstaller-sub.osp.opera.software/Lsetup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2325673306.0000000000F39000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://api.config.opr.gg/v0/config?utm_campaign=ogx&utm_medium=pb&utm_source=OFT&product=gx&channelsetup.exe, 00000004.00000003.2517760672.0000000000FA0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://www.deezer.com/fi/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://download.opera.com/download/get/?id=52318&autoupdate=1&ni=1csetup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://download3.operacdn.com/setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://crashstats-collector-2.opera.com/installer.exe, 00000010.00000002.3218122175.0000027DDB320000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000003.3216925350.00006F000002C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://crashstats-collector.opera.com/collector/submit82assistant_installer.exe, 0000000E.00000002.2703079898.0000000005039000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://www.so.com/favicon.icoinstaller.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_mediuinstaller.exe, 0000000F.00000002.3215206621.000078B0000E4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://www.deezer.com/mx/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://desktop-netinstaller-sub.osp.opera.software/tionBasicsetup.exe, 00000004.00000003.2517944427.0000000000F39000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              https://crashpad.chromium.org/assistant_installer.exe, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                		unknown
                                                                                https://addons.opera.com/en/extensions/details/dify-cashback/installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                  		unknown
                                                                                  https://www.deezer.cominstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://duckduckgo.com/?q=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://yandex.com.tr/search/?clid=1669559&text=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://crashstats-collector.opera.com/collector/submitassistant_installer.exe, 0000000E.00000002.2703079898.0000000005039000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmpfalse
                                                                                          		unknown
                                                                                          https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earningsexplorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://autoupdate.geo.opera.com/api/prefs/?product=Opera%20GX&version=114.0.5282.123setup.exe, 00000004.00000003.3252654512.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252788304.00000000048B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3253008231.0000000000F94000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://opera.com/privacyOperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                              		unknown
                                                                                              https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://gamemaker.io)OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://duckduckgo.com/favicon.icoinstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://www.google.com/favicon.icoinstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://autoupdate.geo.opera.com/https://autoupdate.opera.com/me/OperaDesktopGXhttps://crashstats-coOperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://download3.operacdn.com/Asetup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://download3.operacdn.com/Jsetup.exe, 00000004.00000003.3253008231.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261130813.0000000000F3A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://www.deezer.com/ru/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://outlook.comeexplorer.exe, 00000012.00000000.3110957749.000000000C048000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://gamemaker.io/en/get.OperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexplorer.exe, 00000012.00000000.3107242903.00000000099AB000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  • URL Reputation: safe
                                                                                                                  		unknown
                                                                                                                  https://gamemaker.ioOperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-theexplorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://desktop-netinstaller-sub.osp.opera.software/v1/binarye.netLMEMPsetup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://translate.yandex.net/main/v2.92.1465389915/i/favicon.icoinstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://crashstats-collector-2.opera.com/oinstaller.exe, 00000010.00000002.3220622111.00006F00000C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://browser-notifications.opera.com/api/v1/Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 0000000C.00000003.2698025934.000000000346E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-explorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://www.deezer.com/us/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://api.config.opr.gg/v0/configOperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://www.so.com/s?src=lm&ls=sm2297808&lm_extend=ctype:31&q=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://www.deezer.com/es/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://www.deezer.com/de/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://www.deezer.com/th/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://crashpad.chromium.org/bug/newassistant_installer.exe, assistant_installer.exe, 0000000E.00000000.2701102768.0000000000357000.00000002.00000001.01000000.00000011.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://www.unicode.org/copyright.htmlopera.exe, 0000001C.00000002.3190948892.00000262B4FC0000.00000002.00000001.00040000.0000001C.sdmpfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              		unknown
                                                                                                                                              https://yandex.fr/search/?clid=2358536&text=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://download.opera.com/download/get/?id=52318&autoupdate=1&ni=1setup.exe, 00000004.00000003.2314219860.0000000000F7F000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3273664748.000000003F890000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3256956589.000000003F826000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3261869773.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2732049628.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685766507.000000000489A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2685721625.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3271367338.0000000004880000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://listen.tidal.com/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://schemas.microexplorer.exe, 00000012.00000000.3105831810.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.3105794816.0000000007B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.3094263658.00000000028A0000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    		unknown
                                                                                                                                                    https://search.yahoo.com/search?ei=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://download3.operacdn.com/res/servicefiles/partner_content/std-2/1714144780-custom_partner_contsetup.exe, 00000004.00000003.2732108738.0000000004899000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://autoupdate.geo.opera.com/api/prefs/?product=Operasetup.exe, 00000004.00000003.3252654512.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.3252788304.00000000048B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.3271500365.00000000048B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://gaana.com/installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryetmsg.dll.muisetup.exe, 00000004.00000003.2325673306.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000003.2517944427.0000000000F5E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://yastatic.net/s3/home-static/_/92/929b10d17990e806734f68758ec917ec.pnginstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://net.geo.opera.com/SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2252879060.000002269FE9E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, 00000000.00000003.2250204331.000002269FE9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://crashstats-collector.opera.com/collector/submitllassistant_installer.exe, 0000000E.00000002.2703079898.0000000005030000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 0000000E.00000002.2703079898.0000000005039000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-hexplorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-quexplorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://yastatic.net/s3/home-static/_/f4/f47b1b3d8194c36ce660324ab55a04fe.pnginstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://www.deezer.com/sk/logininstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://extension-updates.opera.com/api/omaha/update/installer.exe, 0000000F.00000003.3142132099.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3142171103.000078B0001D8000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://nova.rambler.ru/suggest?v=3&query=installer.exe, 0000000F.00000003.3141985642.000078B0001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://excel.office.com-explorer.exe, 00000012.00000000.3110957749.000000000C048000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://open.spotify.cominstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://accounts.youtube.cominstaller.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://suggest.yandex.com.tr/suggest-opera?part=installer.exe, 0000000F.00000003.3141985642.000078B000194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-darkexplorer.exe, 00000012.00000000.3096136502.00000000073E5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          https://legal.opera.com/eula/computersOperaGXInstaller.exe, 00000003.00000003.2263963839.0000000003453000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000000.2268980940.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000001.2269989539.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.3276555885.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000001.2273391337.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000006.00000002.2281314698.000000000074A000.00000002.00000001.01000000.0000000C.sdmp, setup.exe, 00000007.00000000.2287497898.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000007.00000001.2288478043.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000001.2292008198.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000008.00000002.3227766639.00000000000BA000.00000002.00000001.01000000.00000009.sdmp, installer.exe, 0000000F.00000002.3215759921.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmp, installer.exe, 00000010.00000000.3081947882.00007FF6E5828000.00000002.00000001.01000000.00000012.sdmpfalse
                                                                                                                                                                                            		unknown

                                                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                                                            Public IPs

                                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                            82.145.217.121
                                                                                                                                                                                            		unknownUnited Kingdom
                                                                                                                                                                                            		39832NO-OPERANOfalse
                                                                                                                                                                                            82.145.216.20
                                                                                                                                                                                            		unknownUnited Kingdom
                                                                                                                                                                                            		39832NO-OPERANOfalse
                                                                                                                                                                                            104.18.25.17
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                            82.145.216.19
                                                                                                                                                                                            		unknownUnited Kingdom
                                                                                                                                                                                            		39832NO-OPERANOfalse
                                                                                                                                                                                            185.26.182.111
                                                                                                                                                                                            		unknownNorway
                                                                                                                                                                                            		39832NO-OPERANOfalse
                                                                                                                                                                                            185.26.182.122
                                                                                                                                                                                            		unknownNorway
                                                                                                                                                                                            		39832NO-OPERANOfalse
                                                                                                                                                                                            185.26.182.112
                                                                                                                                                                                            		unknownNorway
                                                                                                                                                                                            		39832NO-OPERANOfalse
                                                                                                                                                                                            185.26.182.123
                                                                                                                                                                                            		unknownNorway
                                                                                                                                                                                            		39832NO-OPERANOfalse
                                                                                                                                                                                            104.18.10.89
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                            192.229.221.95
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		15133EDGECASTUSfalse
                                                                                                                                                                                            23.38.98.86
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		16625AKAMAI-ASUSfalse

                                                                                                                                                                                            Private

                                                                                                                                                                                            IP
                                                                                                                                                                                            192.168.2.6
                                                                                                                                                                                            127.0.0.1

                                                                                                                                                                                            General Information

                                                                                                                                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                            Analysis ID:1544572
                                                                                                                                                                                            Start date and time:2024-10-29 15:36:05 +01:00
                                                                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                                                                            Overall analysis duration:0h 13m 31s
                                                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                                                            Report type:full
                                                                                                                                                                                            Cookbook file name:default.jbs
                                                                                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                            Number of analysed new started processes analysed:24
                                                                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                                                            Number of injected processes analysed:16
                                                                                                                                                                                            Technologies:
                                                                                                                                                                                            • HCA enabled
                                                                                                                                                                                            • EGA enabled
                                                                                                                                                                                            • AMSI enabled
                                                                                                                                                                                            Analysis Mode:default
                                                                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                                                                            Sample name:SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe
                                                                                                                                                                                            Detection:SUS
                                                                                                                                                                                            Classification:sus34.spyw.evad.winEXE@81/623@0/13
                                                                                                                                                                                            EGA Information:
                                                                                                                                                                                            • Successful, ratio: 71.4%
                                                                                                                                                                                            HCA Information:
                                                                                                                                                                                            • Successful, ratio: 85%
                                                                                                                                                                                            • Number of executed functions: 171
                                                                                                                                                                                            • Number of non-executed functions: 248
                                                                                                                                                                                            Cookbook Comments:
                                                                                                                                                                                            • Found application associated with file extension: .exe

                                                                                                                                                                                            Warnings

                                                                                                                                                                                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                            • Execution Graph export aborted for target setup.exe, PID 3928 because there are no executed function
                                                                                                                                                                                            • Execution Graph export aborted for target setup.exe, PID 7164 because there are no executed function
                                                                                                                                                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                            • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                                                                            • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                            • VT rate limit hit for: SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe

                                                                                                                                                                                            Simulations

                                                                                                                                                                                            Behavior and APIs

                                                                                                                                                                                            TimeTypeDescription
                                                                                                                                                                                            10:38:36API Interceptor58x Sleep call for process: explorer.exe modified
                                                                                                                                                                                            15:38:38Task SchedulerRun new task: Opera GX scheduled Autoupdate 1730212712 path: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe s>--scheduledtask --bypasslauncher $(Arg0)
                                                                                                                                                                                            15:38:49AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Opera GX Stable C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                            15:39:05AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Opera GX Stable C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe

                                                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                                                            IPs

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            82.145.217.121SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    SecuriteInfo.com.Program.Unwanted.5511.32425.5112.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      SecuriteInfo.com.FileRepMalware.23843.7791.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        SecuriteInfo.com.Win32.Malware-gen.25696.17269.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          Lisect_AVT_24003_G1B_57.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            Lisect_AVT_24003_G1B_57.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              AnyDesk_new_Soft.exeGet hashmaliciousEICARBrowse
                                                                                                                                                                                                                82.145.216.20SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      Lisect_AVT_24003_G1B_57.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        AnyDesk_new_Soft.exeGet hashmaliciousEICARBrowse
                                                                                                                                                                                                                          OperaSetup.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                            OperaSetup.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                              driver-hub-install__28.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                MDE_File_Sample_6a23352b0aa498037d7973b179f9f94f90a8fa9d.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  vL0e7nwV98.exeGet hashmaliciousPrivateLoader, RedLineBrowse
                                                                                                                                                                                                                                    185.26.182.111SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                        SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                          SecuriteInfo.com.FileRepMalware.23843.7791.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            Lisect_AVT_24003_G1B_57.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              SecuriteInfo.com.Program.Unwanted.5510.19662.8210.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                jNeaezBuo8.exeGet hashmaliciousGlupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRATBrowse
                                                                                                                                                                                                                                                  e8iuAWz9pB.exeGet hashmaliciousGlupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRATBrowse
                                                                                                                                                                                                                                                    SecuriteInfo.com.Win64.Evo-gen.247.3191.exeGet hashmaliciousGlupteba, Mars Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, VidarBrowse
                                                                                                                                                                                                                                                      file.exeGet hashmaliciousGlupteba, Mars Stealer, VidarBrowse
                                                                                                                                                                                                                                                        82.145.216.19SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                          SecuriteInfo.com.Program.Unwanted.5511.32425.5112.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                            Lisect_AVT_24003_G1B_57.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                              SecuriteInfo.com.Program.Unwanted.5510.19662.8210.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                MassTube_Plus_1700502_Portable.exeGet hashmaliciousNetSupport RAT, Stealc, VidarBrowse
                                                                                                                                                                                                                                                                  OperaSetup.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                                                                    OperaSetup.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                                                                                                                                      file.exeGet hashmaliciousFabookie, ManusCrypt, Nitol, Nymaim, RHADAMANTHYS, Socelars, lgoogLoaderBrowse

                                                                                                                                                                                                                                                                        Domains

                                                                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                        NO-OPERANOSecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.216.16
                                                                                                                                                                                                                                                                        SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.216.23
                                                                                                                                                                                                                                                                        https://us-west-2.protection.sophos.com/?d=site.pro&u=aHR0cHM6Ly9jbGF1ZGlha3J1ZWdlci5zaXRlLnByby8=&i=NThlN2NjYzYyOTljZjkxNGY4YmM1Njkz&t=QTRyTlRXbysvd3IyNERLT1pJYVNuNlAvU0FLMVAyb2pCN053UGFJSWtBST0=&h=dd65eaa7298b4ffebbd13b01dcbd3434&s=AVNPUEhUT0NFTkNSWVBUSVYfWTd0VrJEAZ1PFPx8UNdDDkWk4HVuGeVZrBnJzV7IfgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        http://www.bollywoodhungama.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        https://beforeitsnews.com/health/2024/10/the-happier-meditation-app-is-offering-free-1-year-access-99-value-3059722.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        https://beforeitsnews.com/health/2024/10/the-happier-meditation-app-is-offering-free-1-year-access-99-value-3059722.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        https://meandyouj.weebly.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 185.26.182.118
                                                                                                                                                                                                                                                                        SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 185.26.182.117
                                                                                                                                                                                                                                                                        https://event.stibee.com/v2/click/NDA4MDIvMjQzOTA2MS80OTAyMzcv/aHR0cHM6Ly9uLm5ld3MubmF2ZXIuY29tL21uZXdzL2FydGljbGUvMDI1LzAwMDMzOTE2NDc_c2lkPTEwMQGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        NO-OPERANOSecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.216.16
                                                                                                                                                                                                                                                                        SecuriteInfo.com.Program.Unwanted.5510.8307.25058.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.216.23
                                                                                                                                                                                                                                                                        https://us-west-2.protection.sophos.com/?d=site.pro&u=aHR0cHM6Ly9jbGF1ZGlha3J1ZWdlci5zaXRlLnByby8=&i=NThlN2NjYzYyOTljZjkxNGY4YmM1Njkz&t=QTRyTlRXbysvd3IyNERLT1pJYVNuNlAvU0FLMVAyb2pCN053UGFJSWtBST0=&h=dd65eaa7298b4ffebbd13b01dcbd3434&s=AVNPUEhUT0NFTkNSWVBUSVYfWTd0VrJEAZ1PFPx8UNdDDkWk4HVuGeVZrBnJzV7IfgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        http://www.bollywoodhungama.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        https://beforeitsnews.com/health/2024/10/the-happier-meditation-app-is-offering-free-1-year-access-99-value-3059722.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        https://beforeitsnews.com/health/2024/10/the-happier-meditation-app-is-offering-free-1-year-access-99-value-3059722.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        https://meandyouj.weebly.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 185.26.182.118
                                                                                                                                                                                                                                                                        SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 185.26.182.117
                                                                                                                                                                                                                                                                        https://event.stibee.com/v2/click/NDA4MDIvMjQzOTA2MS80OTAyMzcv/aHR0cHM6Ly9uLm5ld3MubmF2ZXIuY29tL21uZXdzL2FydGljbGUvMDI1LzAwMDMzOTE2NDc_c2lkPTEwMQGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 82.145.213.8
                                                                                                                                                                                                                                                                        CLOUDFLARENETUSsecuredoc_20241028T070148.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 104.17.25.14
                                                                                                                                                                                                                                                                        file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                                                                        file.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                                        • 188.114.96.3
                                                                                                                                                                                                                                                                        New Portable Document.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 188.114.96.3
                                                                                                                                                                                                                                                                        2DpxPyeiUv.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                                                                        • 172.64.41.3
                                                                                                                                                                                                                                                                        installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 172.67.75.163
                                                                                                                                                                                                                                                                        installer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 104.26.8.59
                                                                                                                                                                                                                                                                        https://trainingndt.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                        • 104.22.72.81
                                                                                                                                                                                                                                                                        Oakville_Service_Update_d76b33a1-3420-40be-babd-e82e253ad25c.pdfGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                                        • 104.17.25.14
                                                                                                                                                                                                                                                                        z59IKE.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                                                                                                                                                                                                                                                        • 188.114.96.3

                                                                                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\Opera_GX_assistant_73.0.3856.382_Setup[1].exeSecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                          SecuriteInfo.com.FileRepMalware.27261.32754.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                            SecuriteInfo.com.Program.Unwanted.5511.32425.5112.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                              SecuriteInfo.com.FileRepMalware.23843.7791.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                SecuriteInfo.com.Program.Unwanted.5510.19662.8210.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                  winrar-x64-620b2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                    vc9dXDjnki.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                      http://picasa.en.softonic.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                        quTbWcnSay.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                                                          2D5770EB59209D2238670233CB2BE6424F7974800B83F.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:Certificate, Version=3
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1428
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.688784034406474
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
                                                                                                                                                                                                                                                                                            MD5:78F2FCAA601F2FB4EBC937BA532E7549
                                                                                                                                                                                                                                                                                            SHA1:DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
                                                                                                                                                                                                                                                                                            SHA-256:552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
                                                                                                                                                                                                                                                                                            SHA-512:BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:0...0..x..........W..!2.9...wu\0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0...*.H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...s*n..|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0...*.H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):254
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.045024851223198
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6:kKtlpLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:NLYS4tWOxSW0PAMsZp
                                                                                                                                                                                                                                                                                            MD5:1BA66E395DB86546F862F313AE6EE46E
                                                                                                                                                                                                                                                                                            SHA1:C8E94BE450721474C358E32300FBFF0A8A61049C
                                                                                                                                                                                                                                                                                            SHA-256:EBD68C159A9E9C4F4186C16A201FC4F6742E4CBD039AC85F349A4A614A066DA2
                                                                                                                                                                                                                                                                                            SHA-512:22CC814C31483A154E2A7330E99F1FCCC0C35E35A430398BD53E4DB19FC1D8426A144B7DEDE57E0C6B748A16A78A63B94B9F538A5B979BDCD7945B7994F77369
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:p...... ....l........*..(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):108944
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.01507977815528
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:1536:6kl87+i7I434SghxuiPGYnPPFsiKCA0S0Ns:6kl87+i7IzhYiNPFZHS0Ns
                                                                                                                                                                                                                                                                                            MD5:D6D0529B07124690739B08E005C7254C
                                                                                                                                                                                                                                                                                            SHA1:A5A3B7B873C1715E1DF11593FE46F147EF8D5A97
                                                                                                                                                                                                                                                                                            SHA-256:85159934E763DE75E731F038C4D92E1C1905AD5108E1DB15AC8B8A354A533412
                                                                                                                                                                                                                                                                                            SHA-512:2B9F895BE4C1731267D5EE3277F6014C179250D140CA6849E3923A0596629B2C3D7C833FB0770029EA8C71B71C7F521B724EA31E945AE45A7422814B1E398F52
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:....h... .......0.......P...........0...Y.......`..........x...........W.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B............................................e.n.g.i.n.e.e.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B.........................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):107120
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.023683097706536
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:1536:CkX/qEm8GF9zzYhgixGxn+I5FN++KBWlWH:CkXiEm8GF94hgiu5FqD
                                                                                                                                                                                                                                                                                            MD5:B6892E76EC3D2477C66E50570BCE0EF8
                                                                                                                                                                                                                                                                                            SHA1:8314616BAFC0877598CFC43E3E16B44D40B047EE
                                                                                                                                                                                                                                                                                            SHA-256:198530A0F7E841E59DE99690FFAC2CA5E459BF47C2702D8C1EC820B0E2C77345
                                                                                                                                                                                                                                                                                            SHA-512:D824D5C4749A498746782EB56399D5F5BE0EB496564E8B74EB42309B4E202A517816A38AB16E0683EF3ADBA7007B1A1F4B01A77EAF510B842F4F36CF3B5EA660
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:....h... ...p...........P...............Y.......`...........`...........W.......e.n.-.C.H.;.e.n.-.G.B.............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B............................................e.n.g.i.n.e.e.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B.........................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):105224
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.040261478646265
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:768:9Yj1N92kuGEmvNvjk0lvLVTI6GNELd4ajybEcPqIUR1vSZq/ZoGm/ypc3hVzuh8r:tk8m7LVTIE1h8i1GHn2ldFixKvi+Ruj
                                                                                                                                                                                                                                                                                            MD5:DC192C31475238BF1BA060C7E77D53B1
                                                                                                                                                                                                                                                                                            SHA1:A35D9BDF5E2E3CEDE867A79D911022BCD799B187
                                                                                                                                                                                                                                                                                            SHA-256:5AF26243321B172ECFD1FF7DECCA2D32282E51F93C6101737BCEF7401D15371D
                                                                                                                                                                                                                                                                                            SHA-512:9FF032CDE643BF4D6521E51C2A5AE66C8C703CADE23BFA845B7FE235A258FD73950D52CA435B7346E20B7F7948159B2E1DD1706B6DD5BE067E89DA53AEF73D8B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:....h... ...............P...............Y... ...`...X...................W.......e.n.-.C.H.;.e.n.-.G.B...............x..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B............................................e.n.g.i.n.e.e.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B.........................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\Opera_GX_114.0.5282.123_Autoupdate_x64[1].exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):149541456
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.999978656099499
                                                                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                                                                            SSDEEP:3145728:r6u5O5/wkU/f6XU5kD8nbfvH9XNNRLENHW66p8sBs:I5/U/yXFDuzduhv6p8sBs
                                                                                                                                                                                                                                                                                            MD5:5EBFCE7CAE88212CBDC767E833D6E731
                                                                                                                                                                                                                                                                                            SHA1:4EE6F93CDB198290E94B5CF6FB79CF27689EE0F8
                                                                                                                                                                                                                                                                                            SHA-256:D3C57AA7DE97F93900760B88B1CC50A7D676BA9D29C865BF5BEFE72936EABDD7
                                                                                                                                                                                                                                                                                            SHA-512:5FE3F8A3713DB951D5FB2B7269A149548F9634942254C201B72DC97D93E7E3826A35BD0075F3BF4D72E9DD9EECA4FDEAFF070B0A23A9BE7C9521473CA7EAF139
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(2S&lS=ulS=ulS=u'+>t`S=u'+8t.S=u..8tAS=u..9t.S=u..>tyS=u'+9tyS=u'+<teS=ulS<u.S=u..5t:S=u...umS=ulS.umS=u..?tmS=uRichlS=u........PE..L...4.if...............'..........................@..................................&....@..................................R..d........................).......&......................................@............................................text............................... ..`.rdata..............................@..@.data....A...`.......J..............@....rsrc................`..............@..@.reloc...&.......(...l..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\1714144780-custom_partner_content[1].json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):242304
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.028776242997077
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3072:+lrEaq+nSpKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:cEe+1btUYOnkrPVZCCUCabNU
                                                                                                                                                                                                                                                                                            MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                                                                                                            SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                                                                                                            SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                                                                                                            SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_users": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\OperaGXSetup[1].exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3313792
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.961256672526251
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:jVAbwPZo8iIk9k6qkbnzlpp+E6k5ucpKx9OA/cIq6XdEHi8kmtxvDTZvjFhBvJ:JA4diGkbnfMEZEcpwHq6NMiaDNbP
                                                                                                                                                                                                                                                                                            MD5:8A3BD58257B48475AE9B793F522E5759
                                                                                                                                                                                                                                                                                            SHA1:EB3F449084D1D7308CD8FD47B3EC47B2F19358DD
                                                                                                                                                                                                                                                                                            SHA-256:D390FD781223BF4062EFE2A642F74770D2E13963C1F481475F2933502B6E2EF0
                                                                                                                                                                                                                                                                                            SHA-512:1D67471E38F24C4F11A50FAD16BA93D19EC7E3478F4A8042822E87795A370AD409BDB6350C86A73FEDC04CB1B008E76F5F69ECA368B7F7C7CF1C9C383E028280
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....m...m...m..A....m..A....m...._m.....m.....m..A....m..A....m...m...m....\m....X..m...m0..m.....m..Rich.m..........PE..L....if...............'.....j....................@...................................3...@.................................H...d.......T0...........c2..,...@...1...C...............................C..@...............0............................text............................... ..`.rdata..z...........................@..@.data....K..........................@....rsrc...T0.......2..................@..@.reloc...1...@...2..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\features[1].json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1451
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.395404934994687
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:YPiRyiRAS3RH4rRUtRCRMR6mR9R5DR3RoRY+RWEIiRGiRCR8xRIjRuAcBpDRJRl6:YqRyiRhRYRUtRCRMR6mR9R5DR3RoRJRm
                                                                                                                                                                                                                                                                                            MD5:E297CF33FDD2A49EB648484FEA3912A4
                                                                                                                                                                                                                                                                                            SHA1:BF313E34E9B33731EBA607CE8AE0762BA6BE8EE9
                                                                                                                                                                                                                                                                                            SHA-256:B9D5DB235003326AEAA41D3ACCBD9F7137A0CDDDC7A19CCA6729A937E3DBE796
                                                                                                                                                                                                                                                                                            SHA-512:B5F40F676E5372950D12CD68604CDA12864CD7A9DF593410C7BABFEA27AF1F0A8B5977F949448FE65C82DD229B474D962219E23326DD1A84217E248CC6344014
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Preview:{"features":{"01979299c8cd":{"state":"enabled"},"13e025f64bd6":{"state":"disabled"},"13eeaf851da7":{"state":"enabled"},"1ad69b007ce5":{"state":"enabled"},"1c4dddb65bac":{"state":"enabled"},"1d24dceb937a":{"state":"enabled"},"278deecb29a1":{"state":"enabled"},"2c1429a5a72e":{"state":"enabled"},"3389f6c15eb9":{"state":"enabled"},"40db6e644d2c":{"state":"disabled"},"50796754ffc7":{"state":"enabled"},"5448a57d6689":{"state":"disabled"},"54726ed4401e":{"state":"enabled"},"56d717ae3ad6":{"state":"enabled"},"5a28d66c82cd":{"state":"enabled"},"603cade21cf7":{"state":"enabled"},"654296fe9d6c":{"state":"enabled"},"818c3ef12d0b":{"state":"enabled","dna_filter":{"required_dna":["64336fb81a04836eb8108d24fbca3aa3682db0a5"],"forbidden_dna":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"]}},"8511df77ed15":{"state":"enabled"},"88edd7903398":{"state":"enabled"},"970fe421a344":{"state":"enabled"},"9ec4e68ae70a":{"state":"disabled"},"b2a2a32b832b":{"state":"enabled"},"b7751444d14a":{"state":"enabled"},"b9677b

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\Opera_GX_assistant_73.0.3856.382_Setup[1].exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1499104
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.985603261747699
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:4ACKcQz8HkfJ8dQnd4GrbwsgY+UfLBCQdI5f3cjCRgCPPWCUZry8k/GUrbN:5pT8HkfJ5eGrbmR0afsXCBrG
                                                                                                                                                                                                                                                                                            MD5:E9A2209B61F4BE34F25069A6E54AFFEA
                                                                                                                                                                                                                                                                                            SHA1:6368B0A81608C701B06B97AEFF194CE88FD0E3C0
                                                                                                                                                                                                                                                                                            SHA-256:E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
                                                                                                                                                                                                                                                                                            SHA-512:59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.FileRepMalware.27261.32754.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.FileRepMalware.27261.32754.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.Program.Unwanted.5511.32425.5112.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.FileRepMalware.23843.7791.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.Program.Unwanted.5510.19662.8210.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: winrar-x64-620b2.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: vc9dXDjnki.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: quTbWcnSay.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            • Filename: 2D5770EB59209D2238670233CB2BE6424F7974800B83F.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                                            Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.|..6....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\114.0.5282.123.manifest

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):227
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.917277468817452
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6:KdhlRu9TbX+A8/5RFYpQPCyXkLPCyXX0CdiYCWoA1G:KLuVA5cpQ61L6G07vWBG
                                                                                                                                                                                                                                                                                            MD5:BEF004F6DEEFF77B89E7F75CB8884647
                                                                                                                                                                                                                                                                                            SHA1:164D5C94EA95EED36A4298E72B864B8B7F8D56CD
                                                                                                                                                                                                                                                                                            SHA-256:22C95D12BF96A02DFDC8A00CD320C8327507CE5A7812921AFAEED87B4CF8E475
                                                                                                                                                                                                                                                                                            SHA-512:252B2887E21BC8BDB41AB7DCAB180EB26BF1FA25C180F1CD6034C73DB5B5B841C80BED62E8FF031DB50461A3071A79F9DAE767A1F958068662188348FF4E3AF5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='114.0.5282.123'.. version='114.0.5282.123'.. type='win32'/>.. <file name='opera_elf.dll'/>..</assembly>..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\44464b55-8a3d-445b-b5c2-89fe4f3b5a99.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):422423255
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.112993693686938
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C5D93654BE64ED2F7D5E23D2D9B55B18
                                                                                                                                                                                                                                                                                            SHA1:B783414111507E0879E861252AE5B933D1D3F2F3
                                                                                                                                                                                                                                                                                            SHA-256:2F19286E1954101CACA4A6DCE00EC29B36A7DBABBDE1EA60CAC53BA5C58E97A7
                                                                                                                                                                                                                                                                                            SHA-512:4C24B160F6A7214C3F0FED51D9248D4D18E47764A6733C115A1617A366B71F9CCFBD0C6E756FBD02449BA5591DC6FDED78429F45391C19EF30C021BF2DD501D0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='114.0.5282.123'.. version='114.0.5282.123'.. type='win32'/>.. <file name='opera_elf.dll'/>..</assembly>...PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C......*..,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka|}...q.s.y^.!.Gh..R....t.g....F......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\150x150Logo.scale-100.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2181
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.807674908350133
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:Pe+1prHq0WWdnFX5lKhqEiJVk10s5pqe/cme:G+1prHqXkhrWqEiJa10ae
                                                                                                                                                                                                                                                                                            MD5:B5A21B88B3D8A42DF265817EBEB742BB
                                                                                                                                                                                                                                                                                            SHA1:E0BE32B4FC158DB4E9783094CCE614922114B742
                                                                                                                                                                                                                                                                                            SHA-256:9635C074C9D8EDDE0BAF3111DBD7DB49CBDC370C4F729C80AC382949F32BE526
                                                                                                                                                                                                                                                                                            SHA-512:21ECE0DCF17B038400D09565438FCE8BE61746DAA0250F2FA9D0526BBA3D1CE6F8DA5CCE944EF8FA685C5EB6CF857B073D2A50ADA44A44A76D84813871FAA5D0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C......*..,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka|}...q.s.y^.!.Gh..R....t.g....F.......gt..6...7YjaU....0.*.......3..l.#.. =.h0t.06.v..C...T.}m..%...g..i,Cq..8.g.q..hx. .>..Kz...1....VF.)..q..$....._Z-.U...(....~>...-z]$.mh.%...e.+.....|.n.2..:...N._R..x..>.|S......i?.P....Q.F.d..U.8..i...T...........I.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\150x150Logo.scale-100_contrast-white.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 150 x 150, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1828
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.716814612583543
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:uIrxqF+qFL9yUaKagPWex0mLgIbPdyFKD0YTkogFey6mkAN7G:3wFRoGagTx0A4KDfTko6eCZG
                                                                                                                                                                                                                                                                                            MD5:0BAE0648C3E320C4D439F158B4FD5531
                                                                                                                                                                                                                                                                                            SHA1:4E860AE24F03522C89BDF37F3CCC10B54832861E
                                                                                                                                                                                                                                                                                            SHA-256:28CE8FCB22080CE1F69346CB0720BBE5662959E413426F00062B706013DA8C28
                                                                                                                                                                                                                                                                                            SHA-512:6A5E4105CCBE1664546798DB057B93622C9CBD6D5AF4967E6BE4E390A18FEC0FFCC807E3331F09ED0DE63ED85569BE7EC5EED5A7C663DF6CE4A5B70E09500371
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR................i....IDATx...i.]U........J..RT.H....T...seV..)b.B.5.@.a.Q..P.c. 2E....eR...P(.....P........I...s..v...y...u......Q.EQ.EQ.EQ.EQ.EQ.EQ.EQ.EQ...S.n...j.."....p..|B..]....>.......9.32.....Y.l.R..*y.\.8.4.....p.K..EY%}.5.h.[*.|.V..i.F..q~...;..W61.M5_..1F...Gj..IZ..u. ...*.w....oS..D.r.).U....j.y.#..y..U..;S.-"...n..v.^i.UW.j.hk...n.....,...LRe[.i.}....H.z@.9.q..".v.U9.""n.)....DD.iX.b.....*'....v5.#..~.$.7.]..Tm.....i......+....m...x.j_.'"NG.]..n.j.vl{..Ls...;.T.=E..3...1;.v..xB...*"^.1U..8...xL,7]...D.9.i.."..N.."...c..D...X...c+.t..8M...[......"f.........R..0R.1..Xh..;ND.=U.ID.a.....v..8...'.uct.....k.q>.q.jc.+b...F....r....AN.....}.....Y.J.k~.;4.3".U....s..$....n.q.b{.q.j......".Y_..E...b.=.S.".4...[...S....Y.6O.L...."...."......i../"..!M.>..4ED.....I..""60x.Ct.i...4.."..f..`(.....4..5.L....o........*W....xX.M...E..C...r.....U...8..<'.G.}D....E.k!.8...ED..iL...V.8.."b.C3[Dl..gED..^....-...NDL.iBs..O...`m..zW...k.A

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\150x150Logo.scale-140.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 210 x 210, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3140
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.81304512495968
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:96:X4+RWiQZwj2bSjtW8+i2elETWt5nQ1pzuiV8:ozEW8+iZECt9kzuie
                                                                                                                                                                                                                                                                                            MD5:7E529063A02E4E83736B0263CB1B82E0
                                                                                                                                                                                                                                                                                            SHA1:17A3C4B76962E90B1D2FA8A49441157949F4DC78
                                                                                                                                                                                                                                                                                            SHA-256:A36A13A5D5E3D39E3018CCC5F8859944C87256F8BE24A3C08A6BF3CB06A26804
                                                                                                                                                                                                                                                                                            SHA-512:571806725F83FECA90360B246D167A8857EDFD9EDC8DC0EF7EEEF80F291FD06088C405A5653513CB8AA309DF08CD609DF85A95E3379E3E5907566C876CA77CDE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............?..B....IDATx................................................{..dg.8....m....m.Z.m..;;y...s.GI?..Su..k=.T#..#.;..}/\.g..:b..a+.....t.A}...q..hq.-.}...`:.gk....tm.$...Ax.....B....c.ih....G6L.....;...T.U0...l....~...........W....=<j.....X..O.....r.Y..-..Q..1.....q`..PC..jL...x.'9........y.b=L.m..(U........a.....W......`:.Me.jh..U0.......;..{..I..|.W..C..4...b.nt.......L..a.........`9.!..7N@.......E.?..$.._.q..6..":.+`....W.O.G>o.F.K.c..G.28..Q.....|.....m..#X......N.P..{:...1.........4...F.....w......Z89.Y.w`.L...v.DC.h'......h...[=...c.2...&ze*h..t..j...@?..cpN......0...KC.....f..F.....2"...c1..m.)y..q..(..C,.e..!w.N@I..q4.......!.A...;q..Y..sy.{...."L.p..#<...'.-8.!u.C#...O;.......y<.=....h.c<.=...5N...s....._...p,..Ia...yo....=...Y..4...t.}m@....g._.......#.M{...t........t...;.bjh..l..84.C8..z....B9..[.D.R..}...r..e.pl...~.....<.~ `...Ep..b...L.^.9..x.vB..IZH.a,k..c..L..U...M0....}.n........H..<.!..B.(Y

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\150x150Logo.scale-140_contrast-white.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 210 x 210, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2659
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.828610258666657
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:zQX9JrPPPPPPnouwOlIbylOhFARjcSY1E1y0fAiKb+Y+GzYvpSYWTX5sPPPPPPPn:z0rPPPPPPojFby+m00fAiKiySSYWTXqP
                                                                                                                                                                                                                                                                                            MD5:EBE7D27ED3B4CB6566A10165ABFAA941
                                                                                                                                                                                                                                                                                            SHA1:FDF7C27058CF5DAF7061756E938A33C1BBB26C3D
                                                                                                                                                                                                                                                                                            SHA-256:0BD63FE653885286E180FBDF6D1DADC66AF242B8ED6BD1D03D8C5ECCC20E91D7
                                                                                                                                                                                                                                                                                            SHA-512:50EC8592D78F00A6387F06E077E0DEF88DB26723C0FB8632C4EA06F2E09488DB0FB82E0EB1F03DA53F9C750F6CEBD29F7889B1DE342E4F0AE69F88C4B7B1425B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...............V....*IDATx...{.]U}......"... .!.#..D .k..:.....5...6B..Q@+..lq.(%my.P..C-..Eb..<L5..<C!.1.$wu...f..}........5..Yk...^{.}..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)u.d.Y.b?t..Q.E.,u......$o.-..rK....nw..7..w.TF..-...5=.r....?N...a.N.....~7..7,...r..-..q.}..R....Ye#y.u...IF2...Z..6.o.F....R1<w..]T..H..zw{.k..Y.L.Fm.k.ay.W.P.....I..,5G..C..........v.]...].-R..A......1.a;J-..>E....Qe'............#^VF.J.J-.....LRe.....|....g.M.e.+<.l$gHM.l..y..T.s#.Ow.o+....=...4....P"..J...("...]...~....z...h...P.*..QD....Fg.a..7m...W.`.j..C.q...E....D........8.i..D...^c...J.,.../.&rH[M..9.4._kfzN..#..bD.....[.D.4M3.....2Cs.........._k.Z%....bs7+...wkf...'.%..D.j..!M4A.z-R.k5.....q+-.*&j,..GE......p..(.j_V"......i.M...7.....E..LUz.8>i..jm....[.T.].F.%Q.;.2.....X.x.....-...b...;EQ..dU...avR[..V...f....`,.....J........K...........NWe.....Z:YT.>..{....-..(.uvV......P.x...m..ku.)q..Z>9vU;.)..xTC........j"..ra..D..(..6...t.Ib.O.....D

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\150x150Logo.scale-180.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 270 x 270, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3904
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.301300867894784
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:Fe0zdfrjvg/ofL7NkqKgOL6bq64wL3XtakhXSTxyfO8cg7WZUScsO62vSQ6Q4MCR:JdfrYoDdbJlXBRSMoj6H626Qr45eg
                                                                                                                                                                                                                                                                                            MD5:F332E088E89B88070EF1EFBECA5B90F8
                                                                                                                                                                                                                                                                                            SHA1:86129A8B1E2E7F78D6CE23C58A37FAC9DA5E566D
                                                                                                                                                                                                                                                                                            SHA-256:6A8F64754C75EDCC9ABC1138E44ACBD7064D7E8E2A28783939241DBD6AFA30A5
                                                                                                                                                                                                                                                                                            SHA-512:2314AAE692C024F914661E46CFD76531DA6C09B94C084FE915A0594625927DF30282D09518A950EAFCFDD2E499B1E4877CF3CDBF5509DE0CC756DADCDE43FD45
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............Oo......PLTE.....N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N...*....tRNS..8Uq...........jO+..D......o3.0y..b...g..a...@........_....d'...7Qp......K;..^h.\.W.../...S....-..J......&......Y..I!.P.w#...uT |....:.V...1.z%.Fn.6....N..L..$.2.?.e.s".ti

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\150x150Logo.scale-180_contrast-white.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 270 x 270, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3673
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.8322183683928195
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:96:nBWR5fosUcvpqnOtkeU4ghCboMmSaj+5UZy:MvHUUMnOtpz4Csz65UZy
                                                                                                                                                                                                                                                                                            MD5:98B9F7A4F4322E7B46DE392FD20F66E5
                                                                                                                                                                                                                                                                                            SHA1:D009D227522206C40CF592E460C9642CD03B8769
                                                                                                                                                                                                                                                                                            SHA-256:A706B332E6A846357A86C30D0E8BB7697E7DD55C2AE592DD45611DDCE0C0BF14
                                                                                                                                                                                                                                                                                            SHA-512:3B3E5BAF3CFC57119E0812DE2816DF6C7DCB42E96C4891E47C4F32320FD3BE2F27A0118051A6651595BAAAA30069BB1C0D78AA701744A44534CABE7547D4BECD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............1.... IDATx...k.u.......:.....*.o..I..J...L.H.(a...1....6S.....b.6..2M...fD.M..TN.5..o qx....;g..}^........."""""""""""""""""""""""""""""""""""""""""""""""""""""""q2.3Qr..z..<r....D.w.2.".r.*...s.......\..)d+.XJ.A........8Vq....g...vo.%..B..._M{.a&.XZ;.|r.v%."NaN.Q..R6....c.cN..~H..M1.X..a'%.d,=iZwF2...;.l.xU.H[..i.6;q.....#.y...w...... m.$~..$...L\E...l. .IM2s5.==.%..-....|.:,.`..........<.c-.".\....l...3...j4...B.sn@....Oxb.%.....B......$...-...WC).j..ru.s+.{.2"..5.c.q.e-...;.`-O1...@.G.F3.El.'..>$...(....d....6....%.CG\.e.[8.5.!.#....`q.3.W]X.%...$y...&...DZI....K..W.x.....%.......H+.O%../..n...~....C4...9nAZ..`..F...2.S.khhtz.E.(.CX....Uf....^&J:..@....$M......(.2..U.].O'vc...mzxlm....obq.M6....,.."H...}J'\yll..,....Jx..$/..X.uH.&.].....r,P-...[9.Q...Lr:....(..>..|..;.h4V.%y.|.]...$#....[[..d...U. ..B.H9..d.26.#.w..5.b....q....oq..0Z.y.NP..1.c.V!!.D=.k1.:.?.q'-..w.]..B,P..B...|....+X....j,..2q....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\150x150Logo.scale-80.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1723
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.769427546963699
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:MtXb2ikqrN+EMaUeTPMSEGS6CT/GF2MdJtDHBkZH39Hmgwiw:CXbzrzfUsUGS6A/ETJtHBYNG1iw
                                                                                                                                                                                                                                                                                            MD5:1F2FB1BF463B2FF2BEC96784DEBFEF84
                                                                                                                                                                                                                                                                                            SHA1:AE6F721AD937FE39F86602F71002435B18BF1EDD
                                                                                                                                                                                                                                                                                            SHA-256:7E6B0D9EA7FDA1B5CA7A0B01290521DFF943DA4CBF1498412CA7D749DB42C32D
                                                                                                                                                                                                                                                                                            SHA-512:0C92C4F75E620D0B636CFD83E89C69A44F6A96A00006FBD0B13637BA5DCC77C9B302029E62F4B80766811F31810F9C20AC1A98B65C38789951CA0E19A5BB6894
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...x...x.....9d6.....IDATx......... ..................s....P...m.m.m.m.m.6N......w.......-...g2/...)z.....K....~(^..`...j...z.^Sc.n.,.....0.VW..al6...a.....R0...k.Q..N..P.x.J[ol2..)o...A....x.....c.m;F...t.16.....L8....vb=AQ0.<.X).@....M......g.....k..,.AN...-..R......$....b..`...... %H....`6.g#..h.]q..5._.@dA..c0.;X....a.. .2...~..;.1..:.x.....q[@R....,4.w.v.._..s;.b..s.Qu5..U.|.6Zj...P..........\...qa. ..D..W.L...c.~.....A...F1g@x....V..`..,..D.=..d.i..Q...o.c...N......$.`....]...P}.G....BT. .?.......L.n..+nG./..cC.>0.N1.\.C..B..4.l./L.3....T.c.S..bf.0..t...J..!.aU..p`.....0./..}.iL.).w..hc.M..'.. ..;'.p.Rt....R.g......8.%14...S....<.Jf./@..U.h'.G.R..D.\..z.4......<....*2K.S.bj.1....=.../pd.........cfPL$7....S[.M.%H.M..W..T...ZP.aA~....D...+..~EYK.#..zOZ.]fA~...fz..].....7.>..|.........[...v..M..vb.........L....z.`.P...X..RP{.....`...+.0...l/..>...i.w...W. .....x....T...............t..+B}d*`/..+.;L...J..._...iC..pv..gA~..k.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\150x150Logo.scale-80_contrast-white.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 120 x 120, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1425
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.721284228612739
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:sRv0SxfL9UEp3g4/RjUG894TBRVPvhjfghucgXy2nRlWzIXQuohMU9ocyMDh:sRv0sq4/tU10XVPZjhy0Izy9srWcyUh
                                                                                                                                                                                                                                                                                            MD5:17471BB63ED62A6E545B6B626A763511
                                                                                                                                                                                                                                                                                            SHA1:586B9EFDE7B3A04580A49F8FE7739593D42D303E
                                                                                                                                                                                                                                                                                            SHA-256:DFD1054F989CDEE25F19EA792F363F042A125CAB537A424F0224BBEE13607E39
                                                                                                                                                                                                                                                                                            SHA-512:F619D963B62EDB07C8077C3C6AE60ED8D3F3DD5BB1D05A2B83DCA1A7A4A346598B055F6C7EA22E05BF281B1DE0F205F5D1054819000759D9450EE1FE8F6491AE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...x...x......m.Y...XIDATx...m..e....}....d...9]9\...r2..L..37...S..."s..SV..].t).*.I..dh.Em..`A ...9.`......./..u.}...........v].KUUUUUUUUUUUUUU...~.p.....M.6Y..l.]...Fv..W;..o..d.l...r..{.d..r....a....r.y...@..>.z..C.l.qh............7{E:d.w.W..ZD.2[.~_..y^4.q.!./;GK......Z."s.m..9...{^.g...g...i..[$"F..x.Pj9.b[E...,.q.^.......v. w...4.I.E\....D....9......C".Q.._El0].=.Z`?.>gD....&Y-b...+E...(.f..~`..."^....Z...:\.h....S.v.v-KE,.8.....W.....Ag.V.....q..yD.<..6....x.d.N.....d..?.Q...[..".WZ&.,....v......Z...vG..k.4."...tv....".T.K.L.q..sQZ%.M3V..D...D.!.-.T.*b.n|W.u..xVl....X..._.."...n...5...W.?.1U7Z...p.>#.R.p..#QzJl.;D\..;E....Q..zl.w..wD.4 .j.u....D,.SE<..Bl.........U.Z.[D..._.4K..u.....mJ.e....&.m......-7*..X...:T.K.}..;~....."6(...O..(M..=.#.q.{..xHl..E,...v...3.`......X.[.E|S.IF......C.b.....r......9....o.\.x..WM..J..5.&.IJ......|...........q.J..!{t9L.Y.}D./5.."Vv|./4V.v....i...8Ji......ae18...>.q....0...X.,

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\70x70Logo.scale-100.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1564
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.78686155071436
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:kO3Sxd5HLMZAoBjXkaBPxrX6hzB6eCvTYJSM2nY2YptQ/ceAV5ulBbYZwix2:MLLMWcV2z8nryWY2SDV5uPsqiw
                                                                                                                                                                                                                                                                                            MD5:C3722E0232EC20AC8F99CCE7A040B294
                                                                                                                                                                                                                                                                                            SHA1:91CA47DA87EC045ED3EF5D97243167F08FB9E10B
                                                                                                                                                                                                                                                                                            SHA-256:A333D7E4293F5269426B3FCB673A284F3708A66F957DE62403B6570B24BAE8F5
                                                                                                                                                                                                                                                                                            SHA-512:71940B8431E36307BA5176939A169B9259BB6B43C32529A10A12C5EA31447BDDCCAD7EB9EF7CB309B175EE7BD56E70926BD5AA0855D0FD9497547ECD7FF93158
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...F...F.....q......IDATx.....L../..m.m.m.m.m{.._...+...d...[.|..y.'.{8..N8..N8....x0..$.iA&..d..@r........&X...../.z..../.....{..../u~....|.._4$5..4...6....q..P..D.U...u...W....o@#..j .o....j...r..MI.n..X.RI.]..W*g.g..;...|.D...2..._.#..$.....A......I..r..GOF#F...L)..P.8.....G.. .l.m..J.=(+.{..@#....CH..|.:..n.%..0..*.{...O.+.Q.ORp...7L)dxS2H..Ge....e....$..k....iJT.~...eZP..A2....g..PUB..|....v.......>..k..~h3...40.x...(.......v.%.F......vl..h`>...P...4...W4.D...\o.9...z....3]........`.}t.......XI.[z..%....S<.e... .D..TA...'.....h....l...,...$7.......0,%....I[Au"...d&?.j......,..|...~F..pB...]......L.]d.v5...U%..h:}%..._.$...X.m.....S.yL...Bc.R;K..8...*..TiP.}5.g..p..m..s].ZU....H.{P.!,..?......t.U....=m-<.a.v..I$...u.T5..LG..b]...c6.19d;k%...3......,..I.[.1..:...YN...h.*5...W..._....dL6.v.Rch..~...i.1G....|].AU.k...H.[Q.a,6.5-....Gt.9U......n(.#...D.v......_.*...@I.}...i.u.@..w.T%..*.&Y.:o.X..3.Z.m..fW..5.....D...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\70x70Logo.scale-100_contrast-white.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 70 x 70, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1341
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.829707677562043
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:vHNfCYvjHq3yow73tnF7H1r8IR07iBa/ptAFjLmocqM3LNpi+MaG9vz:vHsY7Hq3QzT7H1r8Wr0/zAxfyLNp1Pab
                                                                                                                                                                                                                                                                                            MD5:504D80D276ADCC0163A8E4720013F9E7
                                                                                                                                                                                                                                                                                            SHA1:6D34A0593FFCE916CD19B66D61004FD7E7EB2CD1
                                                                                                                                                                                                                                                                                            SHA-256:EBBE0B4761EA8968A0A3FAFB383AC7AE175E98CD31A0F41BDF5FCB43469B58EC
                                                                                                                                                                                                                                                                                            SHA-512:9961259704FF97C0E1899A33259F62155B73264E272064F3FA90E64124513C7C8BD6AB69A39C1EFB271ECC2972AB8FD86FB836F22153A9BB35419C3816D11337
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...F...F......'*.....IDATx...{L.U......#A../.9S.&:/..%]ti...TL][Hm.n..8,gsZ..Zk....:u....lF...".I..[.H(.q...{.sx.</......y....9.9.<."""""l%.J..2.L...xFp?...?.8....:N.M..`2.i..M.uZZ+'..C......9.f.1.X.}He....b...$..V.."..'T........[.s..}..F.........t.lnK..d.5...Yr..ld..x.\...iP... ....X......a ...i.C.D.E.H.&......Y....h..G.....1..h..C..>t...$...m..+..../.<.n4.."..(w..%,.R-...t.$.?..#.QB.+.ep..-.....r3.LYo....A...1CVK..$=.ER....}.o.m<.....#....D]O 1\..}..^....,.|[..L..j..`...n.,...C.N.K..U...k..(.IF......1.....B6..X..U......oK..cvm...tP.....,lM....iAq.+...~.t..M.&...0......i(.y.Gq......Zw.,.H.|... .H...zXR...>....K... )S...E......V..H0UR*...P.....\.I......n.fj*.*|..1...U(=.....~@=.X....Hq...4.....D..4S-...x.t;.....X0.....`....j....+..X8....z.t..DV.6c.\....=Ri2.y.{ac..../Gv./....X.n..o....x..ha.d.....p..V.QRg....8...?.[Qrxo!...r....Ni.4tOHz...Ca...z.K....er....3...;....(.0..[r)6.J.3.S'..(.v....l..~t..".&Fwx..M....P....>.7.E.Z.Y.%.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\70x70Logo.scale-140.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2005
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.837796638299837
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:FtyHJuovwDhlXRvUCvqfPAuwdESKbtU04aQkClnRU8lbPxbsFIV4hEIA:FtygGwDhlX1oHO4KwCAQ9MEIA
                                                                                                                                                                                                                                                                                            MD5:667BFBAAEB2D2B372B6E0D4BF4992CE4
                                                                                                                                                                                                                                                                                            SHA1:4C6C2E07183963F59391945FBEE077B55F8F6B2A
                                                                                                                                                                                                                                                                                            SHA-256:207519F1C7B6C7509BFEB7B55724997EEC6456C8BAF55E882E72FC5CD43DA221
                                                                                                                                                                                                                                                                                            SHA-512:AC63A3DD2F6088E7849E3824C35FD58CA78EC77DC31E1F6CBD47DE7CC394318CBA7D2309912206A94180267BE057C2AF5C835424019E2A03EE33A2AB801BA9A4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...b...b.............IDATx..........S.d..........=...F...m...5.r..........m....g{......[1..q./.D.B."......)h.a.o..x.p..r....]..\....b fR......W.a.."..Ix............58.G.G%D.....0lE..E1D.<...u<o...6>....-.`..FX....l\.....K.....{..Y........D...............B.<G.....7.5...8...\....?.!j.b..F..PH..X....8."..,..R....X...((..G.0..&~a...{..DA<v.....H.4Q.u..a..#<Bk...E ..b\@'...3...U.\..4M...o.m.m.m.m.m..$..R9......&..NMW..{..4].....m....h..y/..x....a.[e..7.ua.^.lC8....l0....1...r.&........G.......c.....d....F]...M.a&.M..V..?[..t.P.Xx...*<.(...s...'.Q....'.~{_......8....R.%..7|O.Bl......Sr....^..@..........us.".M..?x....*.T.....A....&.l........H`g..."...I}E.7..].=...C.gz........V!.EE.....7WvB.!.d..vJ...k.{?.......1.n/.Q.{.....LD..;k...\....]G..S.+....F3.}z.=F(.....$..D.[.y.... /Q..eU...]M.[r.......}.f.s..;..!...s..C...x...Y3...<....0.O.p.\..&5...f.u.....4..A..".. .lD..7.#..P.../.i. ......+...M...}/..U\...}..Ah3"t.....D...!v..V$

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\70x70Logo.scale-140_contrast-white.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 98 x 98, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1697
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.76630495035972
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:TyhJvOYkuSoLYIWawZM7SkzaacHxXgr4RzhQpKP7C:6JWiEIOuWkCxCSzhQpCC
                                                                                                                                                                                                                                                                                            MD5:93223E8777B581E988B703DF82593B17
                                                                                                                                                                                                                                                                                            SHA1:40A035464C27041CCC87C7935C45100D93D1C948
                                                                                                                                                                                                                                                                                            SHA-256:464AFAF960C32ABDC2C3937A48BF14C5D1A819B017E719FDED591D43A65D94C4
                                                                                                                                                                                                                                                                                            SHA-512:B8A3EE4A71E609625EAB51F0F6DAFCC82CC47BA2C567CC8BF73CF6423056F9171276289BFDCC8428B7C07645097664065EE9B0B78874425BFF800178222FED12
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...b...b...........hIDATx...........9.Q.f..ttS....u....%..1.a.s.!f..c.b.b.K7QFg3..Y..2M5..6:B..z9.%..N.s>9.{.=..........|.7------------..QNt.G..].E.....b.s.e..X.C...Q.b.;.p..m......g....L.\te.G\.d...F..X..=f..]y.A..\e.t....Ei''...d.X...X..7[TYh.1J..g...y....]/.,r...........mi..2.6J.6Yte.....g.....<o...;..v.T..KJm..\T....i...G.."Qe.c..1.I.T#.6...2...7.y.K.*'.....p..J.2S.V...zf..Z%b..Z.6.z._j.}K..w..R.2.Y..M...P..l..d.JG..Sm..0V..o.u.'R..6...(U.k...k.+m..i].n.ub..D.b.JwJ......-1..(. U..|.^....(."UO..z;.@,2Vi..D,...;K.NAi.."f.TO.j.XlO..}$..M6..".iC.."..MO]-..[(]"U.i..E...J.K..zn..".V..M..i....q.(=%.5...R.e...:P."..(.*U..[...M.G~C......Q3)..]o.%U.*./.c....t..:J...q..k...g...R....\...A.@.kl...H.vJ...x..../....9.:..?q...Y..":@i...4f..E.Yi.T}^.....Q..#..h.#"...4S.y.l...AiG.kl.QWI.nJ.E.F.}M.tP...9...U.f..g...../....]..U:N.{..B..A.2..i.Ru..A"..+jg.kE./Ru..R.g.D...n.q..X-b...f...b.+.q......gD.Y.....q.....t..kA.."&j..Ru..."...j..D..4n.S.wD..gG.x..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\70x70Logo.scale-180.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 126 x 126, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2699
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.8799233652993115
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:Is+9LgA+9fj19UhKwdgrviOztr/CrWbqCLRTFxFCEEgq0Ol81sqAGz:IlSN1gBTOztr/jbzdh1y0wl1+
                                                                                                                                                                                                                                                                                            MD5:704D0A2693B350E7C463B0FF2143835B
                                                                                                                                                                                                                                                                                            SHA1:0313AD4C3690A590AC54552D2C27806E73776600
                                                                                                                                                                                                                                                                                            SHA-256:D6367DBC074E37F3488C26B0BAD229BFE99F5C6BB0E28D37B41906C436152B57
                                                                                                                                                                                                                                                                                            SHA-512:4517B2FA911149885EC5549F3173D3C774716740826873E4B2199C804B17E776A5296565930E5ACDB8D5476710A391B21E6DA8941DF64C525A487DB4619A1EA7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...~...~......#.....RIDATx......................f..`....6..m..j#fm.qm.Am.m......%_...q.i-.>dh.........q.o!!..]...LC.TF..D.o.8...8.O..|.iLC#$PO<..1P.....wX....J..<5...$`O1.YU..g.L....<.....h....K.4Aw.....[.I...yU)....D|..x......`f..................9f....Y...p..!..E..U%...]......l.#.....#gPB.5...^C4.G.........g...5R... ......W.~H@. .*....8.....G...N.U...c....J".....YQ.m0....b.5.V.Y....:.......(W1.E...yb.,..a.bT.^.O!a...6...+!:.*..|O1......ZQ9...M.6.....!.6..O.XI...#jF..w.o.#|c...%Y.h.m.m.m.m.m.......8.qog.N.....3.}...R.....8...P.M.....].....B......3xs...:M!...K.;.mL.7l.N..=..7......sfJ.;..|Q........}:m..08...y.+.5...D..:....|8.m.]........04Z..b.......c.r....|.....m.6/..!...Y..)4._..0KY.e.[.qL.!...X ..jk.....|.....Ki....q...28...-.....<....4.d`.Z{.-]|B..3 PJ.gP.iW-..]m..61c...8.b.,.. P?&.0........A..!_k`.\.s.>.......d..R...."*<.e../.A.S .+...O.Oq.&.B.Y.6...S.!W^....... ..3.A..*...GA.uX.|[..Oh..=..[..9....l-.l..+...mM..Xu_.#)..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\70x70Logo.scale-180_contrast-white.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 126 x 126, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2334
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.8839656878677005
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:W/zeI9zj1u/VwgVNR+vEgxOfU99BpcZlp9uqRhq4eZDU0BMK:W/zn51gxN4RxH9hUlpkAMt/BT
                                                                                                                                                                                                                                                                                            MD5:39E2FCF13C20103C5F449C06D3A4CF75
                                                                                                                                                                                                                                                                                            SHA1:AE8E1BCE2BE17ED450D891864E6AA22642AF39AC
                                                                                                                                                                                                                                                                                            SHA-256:5D46E4056F3915C279F1FA9EDF61D93529FBCAE5C59D616380EC5D9405B7763D
                                                                                                                                                                                                                                                                                            SHA-512:8E4902262B064008804D49D1B5F27BB7B8F33ECEFB05181AA69534E1D21662719DD4F8E0677C58215F6C5CA9EB4FB92FCA54A89F9720230AFBF06A70216ABF26
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...~...~.....H*m.....IDATx...{p......1\0<.%.1<........L.(.0P....R.(Hkk.3.>(-.X.t...>.Q........#P.H.JECxZ.<...5...${.7......../...g........x<.....x<u.0.Y<.f.s.r..7..1.Q.#.#...X...C|.r.......h...b.e..D.[.H..RG.q..f\.9RhV.y....<.Z..0..K.9.c.s(.C9...d=.4..YJ.V....l2..Y,.....u..kH&........rFh.Na.k8A%J..<.-D...Wc.EL'..T~.......I.........N..F...<E.Q$.*.-N2..a.D..;H Jt..%q.....ml......3L$.n..-.Ha0SX..\.#..w..28..W...Z.......Y.......o.......v5.......|...xv.X.G5m.e....tzq.e.7.G.r..Q...D2l.^....E)J..14............~..HCg8...JZ..TN....id..l...3.Vz9...` ....%3.F..v.JG'....Y...,.lc"-.K.]y...h.m.0C.I....".(Gq....g.S>E#....C..+.....].u...+..I...g....b.H....3d.S =.O,.7[...q.|.6/..U.U(.ed.,....DX{.JA}.im;..)..ld.p.*?....QK.....H..i.....#.~&=.&....pZ..&.2....J.s....p..r...y.e.....c..3.g.H.z".#....C'M.h...?......v...&"...z.e(i.+Wz].....<....?....M+s.&....d....*.0n.....s...<Ws?I....?.{...`5z3..w8.........s.B.d..K..K....LLY.j..^...a.p.~.z....-......l.dM.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\70x70Logo.scale-80.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1096
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.755097954664401
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:TDh4JYYFMId219dZt07Zcglb4iS/cFEAAabL3/006Fs:B4JBMPVEbCe/006Fs
                                                                                                                                                                                                                                                                                            MD5:32D3E390613CDDBD639E70DDB2511AC0
                                                                                                                                                                                                                                                                                            SHA1:C96AC088E72D756F31896B16776EF100379F802C
                                                                                                                                                                                                                                                                                            SHA-256:DC20E5AA2B500CD5B5C9F89647D3487810685C94268F22678E27820E2454BB3E
                                                                                                                                                                                                                                                                                            SHA-512:7381CEB8FEE84F398082177F30DC01593BEEFA729C73B0166AF686BCD25D54312B202D9243834B754769DE41E9A1DEED74CA91A76DCDA918A749CDB4F08C124B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...8...8.......;.....IDATx...S.,I....[k.m.m.m...k.f....0..Ag5..<.w.1...r:..g.+...+........MX.k`=l......\(...........,vDq>.......x..`wl.U...x..[.....(..p...@u..z...1M../.D>...z..'vJ..U..'C.......?c:..U........GQ...,.P.T<...-..|$~....q..n=L..iF....X....q.......p.6{q8.u'*.R..C...Qg..YCN.:........#g^.R...w.......U..j...H5..eF......iO`..4r.R.[.....0...9{....u.v....X6!>.F`*.Nk.....J...5.P..}..F.\..Lk._.`.#...od..7..4!V.......-...{r.P....9^5.2.(.G..OT..<9}1....A..Q...U.{C.....o..S.....S...b....z..T...o....z..Z.xv......O|.8.....u......c...?.....u.u........p4.v`......kQ..4.....jzf.^....F..4...j:.._K.;..z]..0.0>..........|..W..Z5!6.b?....2O.....,.>.Q.y..-...._..k..w.}.V....s.o....W*..._Q...X..=Tcmc{N.P..1..j..'...l.-.?j^2..*~}Zo.J..7..F....D.91.....#2^..7.}7........$.:P..oc"6I..)n...|A..G.....l'..x..bM#.|...e.yT...k..y.]9...2.ao.z~.g`4....e0L..........t....n*.....}D.>.O..Vv..vE.Qs.\.~...s..........v.....T..7..A.9.s.]zQ...Gb.q).2....e...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Assets\70x70Logo.scale-80_contrast-white.png

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 56 x 56, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):901
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.682141855410327
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:x2BZqWXRHKkqILfEDtySHnb98XPA8KWstHNMufZ4jJO2C:xZQEC8BywBmPAGpC4jJa
                                                                                                                                                                                                                                                                                            MD5:E6ADD5AFC73F7B06FC2348550595F8D6
                                                                                                                                                                                                                                                                                            SHA1:4D658BDDB93FA6CB423EBC61BD20DB37E4D37DB6
                                                                                                                                                                                                                                                                                            SHA-256:DD6F46D32C3E235508F9E4C7D7F993BD807D955BCA7E63CF3D57C6C4C102F46D
                                                                                                                                                                                                                                                                                            SHA-512:55437DFEA7F68A4572DFC86B5428CBE9DB86C0D32D0B09BA6B7B1CF8E49E5F1BB94285BBDC97D8EE00D70BA75921DB59644787C1BE1672FE37CEE09441F249B6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...8...8...........LIDATx...mh.e...c....#.."aM..f!Dh....eFaa......0$3.a.bS.(!..$..@%1-+.,.ge..\.9..=<...}...=..7.\'7.-////...T.2.x.F...Ur.5.v..L...Iv..-..a.1&...Y!...U.S%..a......k.V!=....'..M.Pl.F!..s.V..B8g.n..9a......Z.k.....vH..i]V.Yx.....ve:R.I-.c.d...\......S.s<.?....`....).Ab.za^.s.1....~r4[...6a.......$6.o.I.z..A.Z.HG.:.r.C..E..<+.#Q..P.J.._.xYX-...[I.'l.o.{...Q.Y.E.'.V..3...H........i'.w...........:a<...W2.I..0P8(K...IL.V....).V......=". .....;.,....F&..U$6.....d...e.T.}aK...4I.!.(.U."...,}-\G.Rx[&..O...$Kk.I$.k.[&..c......S,.v.....(.Ao...,...K[&T..|.......G.G.6a.++t\..*.?...La......F.....r9..t.U.9.DG.8.o#..j.d..L.~..;B....e.f....*,.......b{./.....N.......`.e$npL.U..f.j.I..A....Oa.^.F.N8`...xU.........@?..t%$.,...l.n)._h0/U.d.....l.C...I....R..)..........3H...N....h.9j.2.{.n_...y..m.9.5.^...H7.i.A.....e.?..R....]....IEND.B`.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\CUESDK.x64_2017.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):485336
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.205529609591197
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:ZlTZkQQzVVTgmAffw5QTzL6+75I+qZojZd9:ZzkQQzVVTgmAffMQTjO+x5
                                                                                                                                                                                                                                                                                            MD5:7B7EB669FACC61DF4C6303210D32CACF
                                                                                                                                                                                                                                                                                            SHA1:BA007E3E8CB0D364E28EA32174D3B692A4215F10
                                                                                                                                                                                                                                                                                            SHA-256:BCEAE8A76218A8FCB911BCC705050419D63842E83A30E7C867150C0D740EB083
                                                                                                                                                                                                                                                                                            SHA-512:8B000EC120C94CFEEFC1BA41C6B12E18E90FFF9EF95489811D47C831AFECA4C693C04AC075A7572CA40EB0CDD8E094DAB84D72B30F717D1DEE8DF949A87CABC8
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.y...*...*...*.xE*...*.h.+...*.h.+...*.h.+...*.h.+...*.f.+...*...*p..*ci.+...*ci.+...*ci)*...*..A*...*ci.+...*Rich...*........PE..d....v|_.........." .....N...........L....................................................`.............................................#............`..6.......,F..."...E...p..(...@...8...................`...(....................................................text...hM.......N.................. ..`.rdata...)...`...*...R..............@..@.data....*...........|..............@....pdata..TN.......P..................@..@.idata..X!......."..................@..@.tls.........@......................@....00cfg.......P......................@..@.rsrc...6....`......................@..@.reloc.......p......................@..B........................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\MEIPreload\manifest.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):238
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.824253848576346
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6:v5975JVSS18iMkh26VlcmutLwyAGI/zj//gQNMC:Bbt18l+LlMLqGU/gQNMC
                                                                                                                                                                                                                                                                                            MD5:442699C95B20A60470421C6A4D29960F
                                                                                                                                                                                                                                                                                            SHA1:C7317F2D2414C991C21205BA3C68A187B997E3C1
                                                                                                                                                                                                                                                                                            SHA-256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
                                                                                                                                                                                                                                                                                            SHA-512:C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\MEIPreload\preloaded_data.pb

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8254
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.795641289553097
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
                                                                                                                                                                                                                                                                                            MD5:D5E4C2634EFF8A9B3FAF432BF406D6D1
                                                                                                                                                                                                                                                                                            SHA1:A691F5C9877079193C1F7DFB16DBC30BB0372EC9
                                                                                                                                                                                                                                                                                            SHA-256:C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
                                                                                                                                                                                                                                                                                            SHA-512:B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\Resources.pri

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3072
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.118957212117411
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:Whs+6rek/gF1A6Gbi+4eTy8iPTUucUITUuqQTUGUQTUsITU6UQTUQITUuUQTU0I0:WWnep/FFLxPoRJo+oGpoBo6po1oupop0
                                                                                                                                                                                                                                                                                            MD5:400817D0A91767CB830767AA94383F31
                                                                                                                                                                                                                                                                                            SHA1:73F36C895190223F94E4D52657F14454B2BCBA44
                                                                                                                                                                                                                                                                                            SHA-256:35D92C86C1C054D1C03F4E58B83681BBFD8573143EE5E4CFB4CBD788A1FFC107
                                                                                                                                                                                                                                                                                            SHA-512:2216DFC65E24961A18A4622FF6D8D8A1330283E64477A0E44BAC5B8F9A4CB5690FC90F598BBC152214EE6AA8770FE6608C4C809EC6F2CC73547D8166603B3E15
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:mrm_pri0........ ...............[mrm_decn_info].............8...[mrm_pridescex].........8...H...[mrm_hschema] .................[mrm_res_map__].............@...[mrm_decn_info].........8.......................................................................................................................................................................................................................................W.H.I.T.E...8.0...1.8.0...1.4.0...1.0.0.............8...[mrm_pridescex].........H...........................................H...[mrm_hschema] ...................................U^........m.s.-.a.p.p.x.:././.O.p.e.r.a./...O.p.e.r.a.....................L.......................F...........A...........O...........1.../.......7...!...................................F.i.l.e.s...A.s.s.e.t.s...O.p.e.r.a.P.R.I.C.o.n.f.i.g...x.m.l...7.0.x.7.0.L.o.g.o...p.n.g...1.5.0.x.1.5.0.L.o.g.o...p.n.g..........................................[mrm_res_map__].........@.......,.......................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\assistant_package

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3177160
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.975924065894511
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:xkinojZLgVpd+oiuaGDfQiiscJZ5+yyayOmi1hlAkC9A0rWAc+Vlxo:xkiotWpd+6aGDIiiJZ5P71VC9gAZNo
                                                                                                                                                                                                                                                                                            MD5:D736CFD4C1D3E69367FB1E0E51371965
                                                                                                                                                                                                                                                                                            SHA1:B55D051B0E39A2EE686C4FC43D462986F7BED757
                                                                                                                                                                                                                                                                                            SHA-256:29FDB64309880D9ED6927FC6D21DDE852663F55058E4A61EB18C15D4A544E671
                                                                                                                                                                                                                                                                                            SHA-512:1DA6028DD981817B5BB737A854D342BE900A5C81550BE2CEA925C4F4B07D360CCC63695466F60B27523694C53328503369B4A983F6E96EBDC64F3A9D71B30765
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(2S&lS=ulS=ulS=u'+>t`S=u'+8t.S=u..8tAS=u..9t.S=u..>tyS=u'+9tyS=u'+<teS=ulS<u.S=u..5t:S=u...umS=ulS.umS=u..?tmS=uRichlS=u........PE..L...4.if...............'..........................@...................................0...@..................................R..d...................0Q0..).......&......................................@............................................text............................... ..`.rdata..............................@..@.data....A...`.......J..............@....rsrc................`..............@..@.reloc...&.......(...l..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\d3dcompiler_47.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):4927408
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.40294286771111
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNF:xG2QCwmHjnog/pzHAo/Ay8
                                                                                                                                                                                                                                                                                            MD5:72BE5313F84D782308079A9C64FFF765
                                                                                                                                                                                                                                                                                            SHA1:AFE9FC0AC601A1FFC97D695A9D45BB5914468682
                                                                                                                                                                                                                                                                                            SHA-256:92D57D7D844E6755CA96083E320BE1617E41DBA4E5F8436E20507980CE2123EB
                                                                                                                                                                                                                                                                                            SHA-512:A82ADA8763318B25D1FA65A1F7199FC344DA0364D7AAE1A72BC7D6B1D9D552769085AA460FC685F4149717F59A6E56ACB45043F4622F1E111517DB4C3B1033D5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K.....@tK...`A........................................`%G.x....(G.P.....J.@.....H.......J..O....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\dxcompiler.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):21793688
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.537207193104322
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:393216:4+twcs2jS2y1n/UFQkSvRih2tKA6RPTtZRouTJXGZN0Ky2UyuQDLvrU22VxZQA1P:CMOH0UNQ6cx
                                                                                                                                                                                                                                                                                            MD5:CEBC250931D17FE8880D0E9931DD765F
                                                                                                                                                                                                                                                                                            SHA1:5A60609F42DF4450232D4F2AF233CB183A4FB15B
                                                                                                                                                                                                                                                                                            SHA-256:9459DD9AF513C82CD82B8589E18470539999AC4A4DF0518C003EEEB806B21181
                                                                                                                                                                                                                                                                                            SHA-512:9FFA3804714E7E2BCD2463F57C3E6B377AB276B6B04D8D7AE49C4AE44894BC5102ED552DB6754DE50763B9D5EF1BFF7A3CC077378084E3E3342AD68CD4ECB705
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .........DB...............................................M.......L...`A..........................................$.p...P.$.x.....K.......B.....bL..)....K.....,.#.8.....................#.(...01..@...........X.$..............................text...f........................... ..`.rdata....7..0....7.................@..@.data........0B..n....B.............@....pdata.......B......~B.............@..@.gxfg....0...pK..2....K.............@..@.retplne......K......@K..................tls..........K......BK.............@..._RDATA........K......DK.............@..@.rsrc.........K......FK.............@..@.reloc........K......JK.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\dxil.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1519040
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.5160622489787
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:eCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkrX:eCfhbh3v3mtEAQrW41obCraeRhy9ou6y
                                                                                                                                                                                                                                                                                            MD5:5FF08F81C24CD5C57934AF06279B63B5
                                                                                                                                                                                                                                                                                            SHA1:B891AF17E7A340B5396F3AEAB0AEFB84620F2458
                                                                                                                                                                                                                                                                                            SHA-256:945CDF4A1E8D43DBF64AB4C513E9C0EDDE67F6BB278A33793A7036F18B2D0D42
                                                                                                                                                                                                                                                                                            SHA-512:72AF7D68F4EB9F165691CDA1FF63B6158A7362E02D969903F273B3DDAC68B0DD84DED079165A79915B4C2D639E4B84ABA495B621754A5A5B9957EC009FBE49FD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@AC.. -.. -.. -.OX).1 -.OX... -.OX(.. -.VU(.. -..R,.. -.. ,.. -.OX$.. -.OX-.. -.OX.. -.. ... -.OX/.. -.Rich. -.................PE..d...'..}.........." ........."...............................................@............`A............................................l...l...P............`..t........O... .......o..p....................o..(....m..@............................................text...\........................... ..`.rdata..F...........................@..@.data....{.......T..................@....pdata..t....`......."..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\files_list

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):4218
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.21510827777591
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:QdIlvE+eCPTuqaeDCOLIG4AUsKyIYKJhNewb059RVtZtDy3HCk7RPO2ErgB6D:iIhTf85XZyITJhowbO7Vt+3ik7wUU
                                                                                                                                                                                                                                                                                            MD5:65C85EE878672FB374AF1D3BE098CF5F
                                                                                                                                                                                                                                                                                            SHA1:A1F5E981943EE56AAD45C9A8322B281D7E9120FD
                                                                                                                                                                                                                                                                                            SHA-256:0E0F1F8529349AF2DF1D643F977F3A295DC12DA65B60218741A7A432ECCB4DD0
                                                                                                                                                                                                                                                                                            SHA-512:9387E625255A3A5D07BC6051BD5131702A61F72B31AA682DE9CA973F3649B9470F77AE3BB90E1E5297D981F8A0BE378DDF93A46FC5CC6618A8828ACE322B1C61
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:114.0.5282.123.manifest..CUESDK.x64_2017.dll..MEIPreload\manifest.json..MEIPreload\preloaded_data.pb..d3dcompiler_47.dll..dxcompiler.dll..dxil.dll..headless_command_resources.pak..headless_lib_data.pak..headless_lib_strings.pak..icudtl.dat..installer.exe..libEGL.dll..libGLESv2.dll..localization\bg.pak..localization\bn.pak..localization\ca.pak..localization\cs.pak..localization\da.pak..localization\de.pak..localization\el.pak..localization\en-GB.pak..localization\en-US.pak..localization\en-VO.pak..localization\es-419.pak..localization\es.pak..localization\fi.pak..localization\fil.pak..localization\fr.pak..localization\hi.pak..localization\hr.pak..localization\hu.pak..localization\id.pak..localization\it.pak..localization\ja.pak..localization\ko.pak..localization\lt.pak..localization\lv.pak..localization\ms.pak..localization\nb.pak..localization\nl.pak..localization\pl.pak..localization\pt-BR.pak..localization\pt-PT.pak..localization\ro.pak..localization\ru.pak..localization\sk.pak..loca

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\files_list.1730212712.old (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):4218
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.21510827777591
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:QdIlvE+eCPTuqaeDCOLIG4AUsKyIYKJhNewb059RVtZtDy3HCk7RPO2ErgB6D:iIhTf85XZyITJhowbO7Vt+3ik7wUU
                                                                                                                                                                                                                                                                                            MD5:65C85EE878672FB374AF1D3BE098CF5F
                                                                                                                                                                                                                                                                                            SHA1:A1F5E981943EE56AAD45C9A8322B281D7E9120FD
                                                                                                                                                                                                                                                                                            SHA-256:0E0F1F8529349AF2DF1D643F977F3A295DC12DA65B60218741A7A432ECCB4DD0
                                                                                                                                                                                                                                                                                            SHA-512:9387E625255A3A5D07BC6051BD5131702A61F72B31AA682DE9CA973F3649B9470F77AE3BB90E1E5297D981F8A0BE378DDF93A46FC5CC6618A8828ACE322B1C61
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:114.0.5282.123.manifest..CUESDK.x64_2017.dll..MEIPreload\manifest.json..MEIPreload\preloaded_data.pb..d3dcompiler_47.dll..dxcompiler.dll..dxil.dll..headless_command_resources.pak..headless_lib_data.pak..headless_lib_strings.pak..icudtl.dat..installer.exe..libEGL.dll..libGLESv2.dll..localization\bg.pak..localization\bn.pak..localization\ca.pak..localization\cs.pak..localization\da.pak..localization\de.pak..localization\el.pak..localization\en-GB.pak..localization\en-US.pak..localization\en-VO.pak..localization\es-419.pak..localization\es.pak..localization\fi.pak..localization\fil.pak..localization\fr.pak..localization\hi.pak..localization\hr.pak..localization\hu.pak..localization\id.pak..localization\it.pak..localization\ja.pak..localization\ko.pak..localization\lt.pak..localization\lv.pak..localization\ms.pak..localization\nb.pak..localization\nl.pak..localization\pl.pak..localization\pt-BR.pak..localization\pt-PT.pak..localization\ro.pak..localization\ru.pak..localization\sk.pak..loca

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\headless_command_resources.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2923
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.921852989657323
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:GgAlAoYlilhwSaZDTzolwaaRUFUvexgwO8BKWvhkQzQ1epHQs1EAFw4FGxG:uclnPzomv2HrlpkQzOepwGE14AG
                                                                                                                                                                                                                                                                                            MD5:A2071DAF0E616B5B20B3767F05D98A23
                                                                                                                                                                                                                                                                                            SHA1:FA1FE2A3F81176B438DD26C3DE8AC0350EA46461
                                                                                                                                                                                                                                                                                            SHA-256:DACEC75453155A4FEEB277EB7AD527BF37C60974FB3E807957E9DBE09FC77DC4
                                                                                                                                                                                                                                                                                            SHA-512:A35C87A8047DF8231FE6BB3169BB2941A24413FF5D82FC0F6A744CDA8805C525723B88064AC3B6668ADDAAD7742A6A8911CA4C82CBE7CDDF21F2E8908CB0782A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.............w..../w......k.............-.1k.0.....Kv....h........."=G*.^....Uqo9...R..1g.w..mqv..e.~.x...,+..[.<.8/...!..........6C..tTR.@..P.Xq....-_#O.........4`.P......|...J.5........~.8.6...p.:..l.].l.Y._EY...................N.H....H...t..>M#f..Q....d...n.].......=......&Z...s.s?..}tL.-..+.^..~..V...(YW......no..}.0"%b..C..i.QN...uI6.6.@.[...........U..@c...<k.-.J.7...X........)*...{..!.O....7...u.uv.=.!..t..9#4N.........=......Cg..]W...7...gm...a..k.=..1.E.YO...E@.eE..dcE..F.L;.4D.~9...h......b......+T.mrTT]..|u.....k..I..".xq.;..(.....i.....:.....H...D..(Rd....B.j:!.$.........SJ.....a...s^.<..7.......s....bq.n.S.,.6|......)...2..Riy.*..g.....wet.....?.....................n!..x.@x.T.gMQc.M...0....x.Z.FA..N....2~h..7...1..w.xNq..d..../...zD.#....j...n.c.^.... ..3.t.u.K..=.. ..>...QUDsKg."...5.Hr...0..Nf.n*/L(cP*l...."..t>...b.j.U...C...0Hd%:.e.ENvN[&.1.2...Q.8.zN+u...m...:.GG(j..-...&...et......4#......5fx......7...8v......-.......f.*

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\headless_lib_data.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1230115
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.9823798553289285
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:zqZR+aVG7skZFhN0kRFgcFlO11y+cB1X6oO0TOoa2qlxettXV3i:mZRRG7sknRFP7ZP6BKOzlEVS
                                                                                                                                                                                                                                                                                            MD5:6800C473CD9C578040CCDA4781355EA5
                                                                                                                                                                                                                                                                                            SHA1:9354D0D805B9ED8F454CB47FA936060C845040C0
                                                                                                                                                                                                                                                                                            SHA-256:09C7A060E8705A141492173EAC07764674F41C7A3F9457A2D159923282A07619
                                                                                                                                                                                                                                                                                            SHA-512:BF6EDF94E2AE3292F17B9FFB4DFAE266FCE2866B1BB9E8A57F8A98EE894ABA34E3B8961B9167DC84ABC8D371CC4ACF5CF96F5210D63D9DA18A18BBA4C9E55832
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............f.b...........{............ ..........=................u................$.....:......................wp....w.....w.....w.....w.....we....w.....wN....w.....w.....wx....w.....x....x.....xI....x.....x.....x.....x.....x.....x.....x.....x.....x.u...x:....x.....x....x.....x....x.....x....x#....x.....x{....x.....x<....yB....y.....y.....y....4{.....|.(...|))...|.*...|.-...|.0...|.3.. |.8..!|.;...|~?../|.e..0|.h..1|.m..2|.q..3|.q..5|.t..6|.v..7|.x..8|.}..9|....:|....;|....<|...=|[...>|...?|....@|V...A|z...B|...C|....D|d...E|...F|D...G|2...H|....I|....J|....K|....L|....M|.2..N|N8..O|.:..P|HE..Q|$H..R|.L..S|.S..T|kY..U|,...V|...W|....X|....`|....a|Z...b|....c| ...d|....e|....j|X...k|9$..l|.......1....*2.....2....F3.....3.....4....~5....h6....]7....'8.....8.....9.....:.....;....p<....E=.....=....(>.....>.....?....u?.....?....5@.....A.....A....kB.....C.....C...uD...IE....E....F...@G....H....H...wI....J....J....K....K...?L....L....L..._M....M...2N...5P...kY

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\headless_lib_strings.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3289665
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.979024423342337
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:zUG3KAPPbe7nKrrwz3DtXetd0zLsceUYZeKFLOlXRp97skLrePewz0thJyEz+ZhX:gG3Kt2rwrlzFNYtu397pE2RSvX
                                                                                                                                                                                                                                                                                            MD5:E2FE47902CB82DED9E6E5AA41BA2B80C
                                                                                                                                                                                                                                                                                            SHA1:F8CFCEE741DC4F94631F332267926A1EB1C5376C
                                                                                                                                                                                                                                                                                            SHA-256:81EC7A8B767D8018BA31B6BF1D50083A76B4433C7537863B03AA17474913FAA7
                                                                                                                                                                                                                                                                                            SHA-512:972E5A73E4195D5186146893B77A99C56A5D23F480853B8C1A671A719EB33E75D94DCBC72BD6591E05A4E36418D90D3B49B39A81F904786C746FA7D8CEE1F4C1
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:...............w.....w....-w....=w....Nw.....w....%x....nx.....x.....x....%y....Vy....fy.....y....%z....az....wz.....z.....{....J{...._{.....{.....{.....|....'|....p|.....|.....|.....|....8}....y}.....}.....}.....~....h~.....~.....~..........V.......................,.....W.....g.................'.....2.................=.....Q........................../.....j............................3.....?......................,.....z......................E.............................J.....r.....}................4.....?.................8.....M............................]............................_......................4.....i......................&.....5............................s......................o................+......................;............................_......................*.....w......................._.......................................................................................%.....0.....?.....\.....l...................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\icudtl.dat

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):10501472
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.264566831287011
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:196608:nDPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YmU:nVwkpHiXUxY/iJ53IWhlVjEeIlU
                                                                                                                                                                                                                                                                                            MD5:A1E751E9DF0E72C64F38B613EA2A324E
                                                                                                                                                                                                                                                                                            SHA1:ECCB2490C2238599B990B977E7956471C411FA89
                                                                                                                                                                                                                                                                                            SHA-256:1FEEDB01802A6960C454D4AFD6B1C9BC3E83A4E575E9D6B2F3BA7DB846645BAB
                                                                                                                                                                                                                                                                                            SHA-512:C516B97433645DEF5BB825C9A7FEA7925BD43552D38A33266EFAAC268447EAF3F48984CFE57BB4C46B4EA537B42A24CFE2BB7615B4E65C2949BFAC74DB6730AE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .....dF......tF..@+...F...+...F..0,...F..`3...F...3...F..PP...F...P...F...Q...G.......G..@...'G..0...:G......MG......`G.. ...sG.......G.......G..@....G......G.......G.......G.......G......H......H......1H......DH..0...WH......jH..`...}H.......H.......H.......H.......H......H.......H.. ....I..P....I......%I......8I..P...II......]I.....mI..@....I.......I..P....I.......I......I..@....I.......I......J...... J..P...1J......EJ......\J..0...lJ.......J.......J.. #...J..p#...J...&...J...&...J..0'...J.. ....K...>...K.. .&.EK....&.\K..p.&.sK..`.&..K....&..K..0.&..K....&..K....'..K..0.'..L..`.'..L....'.8L.. .(.OL..@.(.lL...Q)..L....)..L...S*..L....*..L...k+..M..0.+.2M...k,.\M....,..M....-..M....-..M..p.-..M....-..M..0.-..M....-..N...&..0N...'..NN..@.0.gN...m0..N....0..N....0..N....0..N.. .0..N....0..N..0.0..O....0..O....0.6O.. .0.FO....1.YO..P.1.lO..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7977368
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.942334984663354
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:98304:ne7fyaLtjKFLoyxKccbL3b12ybFUIvSrn2vToxRDBxZer861:e7fLLtjKazH3VhU0s2CRDw8k
                                                                                                                                                                                                                                                                                            MD5:E169C65773E40654455624EADD122953
                                                                                                                                                                                                                                                                                            SHA1:FA5A9854596CCECE00D7B5058E915D8DB9A24881
                                                                                                                                                                                                                                                                                            SHA-256:A14CABEAB50A7CF712F2ACBAA8D43BAAFFBF883D9882A1FE49614CB8CD2ACA91
                                                                                                                                                                                                                                                                                            SHA-512:C106CA6A51C82A651BECE1703D50D66FBD847333871A11566E3B602336BB13AC17784114AC35FDD2507DBB7B0795FF699DED07AA35F7359C532CA61DE1D7AA8B
                                                                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......,...^t................@............................. z.......y...`.....................................................P.......(pr......9....y..)....z.....l...8...................P...(....@..@............!..`............................text....+.......,.................. ..`.rdata...U...@...V...0..............@..@.data...`J......."..................@....pdata...9.......:..................@..@.gxfg...P&...0...(..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..............................@..@.rsrc...(pr......rr.................@..@.reloc........z.......y.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer_helper_64.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):565656
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.182954018900292
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:CkwJArFTlSKjFkAcq2xRkQY8WQNXzQW5Y1P3zsiEaMo2Bv8LxIzect5MRD6JKk:lw6F0eQYkNjQW5HVo2Bv0qzZt+QKk
                                                                                                                                                                                                                                                                                            MD5:D3C21B8822988E8AB586BA54459D1DBF
                                                                                                                                                                                                                                                                                            SHA1:B0EF76D40177A48DA91DFE2C71774E6E14AB27ED
                                                                                                                                                                                                                                                                                            SHA-256:46608C45C0D0A80EC800195701230FB54D1A8AAB2B30F5980196E8F3A520E766
                                                                                                                                                                                                                                                                                            SHA-512:AAEFEADDAEE188C0FDCE78289B56E1230732C982E8DFEFE46DB72DF611965235B7E238784CB90807ECFD8E7F07E7AEBD39200398689017DE93EBE37446947BAD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."............................@.............................P......Y.....`.................................................(...x....0..P........=...x...)...@..........8...................p...(.......@...........p................................text.............................. ..`.rdata..Di.......j..................@..@.data....X...0......................@....pdata...=.......>..................@..@.gxfg....$.......&...:..............@..@.retplne.............`...................tls....1............b..............@..._RDATA....... .......d..............@..@.rsrc...P....0.......f..............@..@.reloc.......@.......j..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2363800
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.463059059801415
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:KXMXzfI2p6dfciX/8l6b91G3BKOFABSmuvnjEO:OL9obFA8x
                                                                                                                                                                                                                                                                                            MD5:5C0816F339E37BBA9BE7839D75DEA204
                                                                                                                                                                                                                                                                                            SHA1:0A49DD9E65D63466110BBD74886AAA14A109841A
                                                                                                                                                                                                                                                                                            SHA-256:2772BD094A2CCE47A41526A2D6D9246115621760A594D596F142CFDBBB9E000A
                                                                                                                                                                                                                                                                                            SHA-512:DA59B97CC266E242C00361BE41F48AA383BBB2CAB7E99B32FE82CE0B14EB3D64D16AF91A47FAABE13F902414D6D8B0029268B7D55656DCAF603A15B6F18833FD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g..........".................0..........@.............................p%.......$...`.........................................P...b.......h....p#.(.....".......#..)...P%.........8.......................(... ...@............$..h............................text...F........................... ..`.rdata.. ...........................@..@.data...`...........................@....pdata........"....... .............@..@.gxfg..../...."..0....!.............@..@.retplne......#.......!..................tls......... #.......!.............@...LZMADEC......0#.......!............. ..`_RDATA.......P#.......!.............@..@malloc_h.....`#.......!............. ..`.rsrc...(....p#.......!.............@..@.reloc.......P%.......#.............@..B........................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.exe.1730212712.old (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2363800
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.463059059801415
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:KXMXzfI2p6dfciX/8l6b91G3BKOFABSmuvnjEO:OL9obFA8x
                                                                                                                                                                                                                                                                                            MD5:5C0816F339E37BBA9BE7839D75DEA204
                                                                                                                                                                                                                                                                                            SHA1:0A49DD9E65D63466110BBD74886AAA14A109841A
                                                                                                                                                                                                                                                                                            SHA-256:2772BD094A2CCE47A41526A2D6D9246115621760A594D596F142CFDBBB9E000A
                                                                                                                                                                                                                                                                                            SHA-512:DA59B97CC266E242C00361BE41F48AA383BBB2CAB7E99B32FE82CE0B14EB3D64D16AF91A47FAABE13F902414D6D8B0029268B7D55656DCAF603A15B6F18833FD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g..........".................0..........@.............................p%.......$...`.........................................P...b.......h....p#.(.....".......#..)...P%.........8.......................(... ...@............$..h............................text...F........................... ..`.rdata.. ...........................@..@.data...`...........................@....pdata........"....... .............@..@.gxfg..../...."..0....!.............@..@.retplne......#.......!..................tls......... #.......!.............@...LZMADEC......0#.......!............. ..`_RDATA.......P#.......!.............@..@malloc_h.....`#.......!............. ..`.rsrc...(....p#.......!.............@..@.reloc.......P%.......#.............@..B........................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\launcher.visualelementsmanifest.xml

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):317
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.996593526126476
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6:ejHyaVic4subiL/bWHMjizddDhkQwYZXXKmJfFmkQwYEbghuPYEpwhugVFQ:eF8iDbWHMjizd2O/fbrghuP5whuQFQ
                                                                                                                                                                                                                                                                                            MD5:E8D8EAA4C2826C083AB9243B5CBD7BF8
                                                                                                                                                                                                                                                                                            SHA1:534361AE03417DFD14EBD6F961B707C75A2AF41A
                                                                                                                                                                                                                                                                                            SHA-256:B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
                                                                                                                                                                                                                                                                                            SHA-512:8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\libEGL.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):504216
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.419990223251539
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:zrF9Ltw+L7mUFpkKV2HGAzfN7+yWBr72i9Kd5eXL6r5+Yc:zW+LyUPkKVOZN7iBr72i9KdIXLm+D
                                                                                                                                                                                                                                                                                            MD5:EC2A1757D7622C054803AF531CF365A9
                                                                                                                                                                                                                                                                                            SHA1:FBCFC69BC8693ABF1B1706D5B28497AA2B07B476
                                                                                                                                                                                                                                                                                            SHA-256:FCEB587B830C8C35098B676071CB233EE4E36A4707BCBDF18BB165799CE08850
                                                                                                                                                                                                                                                                                            SHA-512:550E7A03818E383A088BD8823C49196A5FDDBBDF1B6513D6BD69DC991179DE1CF7AC47FA4898386EDE9D621DC35591063F3DB7868EE98968ED4B4809BC5BF564
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....p...........8..............................................1.....`A........................................ m.......{..(.......H....P..x?.......)......8....d..8....................c..(.......@............~...............................text...Zn.......p.................. ..`.rdata...p.......r...t..............@..@.data....K....... ..................@....pdata..x?...P...@..................@..@.gxfg... &.......(...F..............@..@.retplne.............n...................tls....!............p..............@..._RDATA...............r..............@..@.rsrc...H............t..............@..@.reloc..8............z..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\libGLESv2.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8246680
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.501474439807468
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:98304:zDtC6PYdNalX3iwu5z0TcyP7Y86gmw2BKXC3GnY4Y8:zDtC6PYdNehhcbTgMBamGYX8
                                                                                                                                                                                                                                                                                            MD5:BF327099A57387CF0C7A3B4AFB1929F1
                                                                                                                                                                                                                                                                                            SHA1:030562349468D3EB6902845A17F8E5F2B3FD601A
                                                                                                                                                                                                                                                                                            SHA-256:99878908EEADD459E36FD0BB322397205E8D9B3E2B139DB4AD95D451A3424BE0
                                                                                                                                                                                                                                                                                            SHA-512:3043ACAED4B5BACBA7556C34A6B41A4DB41DAB4D3297099077B35FB7E622AF7A325BA4B7CCD908050A9AE7BDCBD02C5965B530796BD34F6AA0123EE1C99F27BB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......a.........0.O.......................................~......]~...`A........................................]#u.C.....v.d.....}.......{..G....}..)....}.\.....t.8.....................t.(.....b.@.............v......"u.@....................text...E.a.......a................. ..`.rdata..$.....b.......a.............@..@.data.........v.......v.............@....pdata...G....{..H...Tz.............@..@.gxfg....-...P}.......|.............@..@.retplne......}.......|..................tls....B.....}.......|.............@..._RDATA........}.......|.............@..@.rsrc.........}.......|.............@..@.reloc..\.....}.......|.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\bg.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):879472
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.782365741500722
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:TipM6CFComgUxcl9cIeIw6g2HV2lfJjvYVzQkECHUjVbsiTqEZkVVDhkbs3lFvHz:QM6UUuGIXV2lfJjvYqqUjVbhTqTVVDh7
                                                                                                                                                                                                                                                                                            MD5:269C1E7FC2729CC06609EFFDD2B7C5B5
                                                                                                                                                                                                                                                                                            SHA1:38C47565B41A300966BCC4136EF2D443523FFA8B
                                                                                                                                                                                                                                                                                            SHA-256:EE46BEB2A83AD98A54EF76ACEAD5C22FF665F4012CFAE31CB40CCB0E20001E51
                                                                                                                                                                                                                                                                                            SHA-512:8BEC21C0B0AF043DBCB2E256D8A82C4B5BF9C4AF9A71EC84CDE94154AD86C80D3F3EED14314CF207D67CED28A84B67344B7A91304637CAE804D470180EDFC7C0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........:(..e.....g.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.|...t.....v.....w.....y.....z.I...|.p...}.........................................................................%.....3.....P.....u...........[...........#.......................1.....N.....>...........(.................U...........@.................:...........U.................. ....j!.....!....0"....,#.....#....r$.....$.....%....i&.....&....&'.....'.....(.....)....-).....*.....*....[+.....+.....,.....-..........d....../...../...../...../.....0....*1.....1.....1....H2.....2.....3....>3.....3.....4.....4.....5.....5....<6.....6.....6....:7.....7.....7.....8.....8..../9....o9.....9....<:.....:.....;....@;....;<....!=.....=.....=.....>....,?....s?.....?....-@.....@.....@....5A.....B.....B....,C....WC....PD.....E....|E.....E.....F.....G....]G.....G....WH.....H....RI.....I....rJ.....K.....K.....K.....L.....M....&N....SN....KO.....P.....P.....P.....Q....2R.....R.....R....gS.....S....9T....cT....^U....2V

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\bn.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1128010
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.3868102923679135
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3072:p/RcWWWlh75ObJn6Il9xXHSnTqBBoZ4lSZcwQy:pFWWlDanZXmqBBRUZL
                                                                                                                                                                                                                                                                                            MD5:C86BD82C0FE76D24BBE423521B0E827B
                                                                                                                                                                                                                                                                                            SHA1:564E50C18221D32C2040702363DA7F78DA50DFD7
                                                                                                                                                                                                                                                                                            SHA-256:8C36F32D2D5803E43E1046AE6D3EFE8C456E4F169ABAB148E650EF7D41E0BB38
                                                                                                                                                                                                                                                                                            SHA-512:BFBC8736FBC4AD1165026C44EDA501BA0947425F449447A31CBCF8339965C4CEDDC14BFD726A8E8EBC09ADCD7566482C273A7B8D94D1FF88D450F303D075DFBA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........I(..e.....g.....h.....i."...j.....k.=...l.H...n.P...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.C...z.q...|.....}.................................................".....).....*.....+.....0.....U...........................................................t...............................................".....].................K ..... ....8!.....!....="....`".....#....e$.....$....Q%....7&.....'.....'.....'.....(.....)....7*....f*....3+.....+....E,....z,....u-...._...........)/....M0....E1.....1....?2.....3.....3.....3.....4.....4....Q5.....5.....5....P6.....6.....7....87.....8.....8....19....o9....-:.....:....);....U;.....<.....<.....=....'=.....=....n>.....>.....>.....?....0@.....@.....@.....A.....B.....C.....C.....D.....E....>F.....F.....G.....G.....G.....H.....H.....I.....J....=J....%K.....K.....L.....M.....M....XN.....N.....N.....O....jP.....P.....P.....R.....R....XS.....S.....T.....V.....W....=W....uX....wY.....Z.....Z....c[.....\.....\.....\.....]....Y^.....^....._.....`

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\ca.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):557244
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.411646267522979
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:yQbt7e6ybGbf1bCCrz+W58rYvOkcvKMe3xR3MfvO5/5iuURKWJCQrEyXLg8SHNa9:o6xM5zRP5kpBo2+qjEae
                                                                                                                                                                                                                                                                                            MD5:5CDE0EE97EE4050E2A1E221AC21EB9ED
                                                                                                                                                                                                                                                                                            SHA1:A10CB55A43D83960CFA7EBCB74BD1068148B6F3E
                                                                                                                                                                                                                                                                                            SHA-256:EABF5BFD60CE4F23B6431BC985C2852420EF5873C948394C3A0395E3E773C670
                                                                                                                                                                                                                                                                                            SHA-512:A9B5330AC627F8A128EF871AE94756DF08C3899AD2B8D2AAF8AE42F6EC2F998FBBC1A97658D5D9104B9F39A8E268311BAA51BD7B2144CE15736F63F332995987
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........*(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.!...r.-...s.\...t.s...v.....w.....y.....z.)...|.P...}.....................................................................................5.....S.........................................*.....C...........\.................D.......................M.......................B.......................b.................7...........).....r.................j................. .....z.................:.................. ..... ....#!.....!.....!....."....]"....."....."....."....@#....f#....v#.....#....%$....R$....i$.....$....3%....n%.....%.....%....9&....k&.....&.....&.....'....J'....Z'.....'.....'.... (....-(.....(.....(.....)....)).....).....*....b*....~*.....*....3+....b+.....+.....+....#,....F,.....,.....,....*-....?-.....-....%.....m............/....I/....l/...../...../....50....a0....v0.....0....:1.....1.....1....92.....2....33....N3.....3....:4....~4.....4.... 5....w5.....5.....5.....6....c6.....6.....6.....7....v7.....7

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\cs.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):550910
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.8472424444714575
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:0fLPTUpNSSgePnYwAChkGYNOrvISB98QfsV/mJuSy9YdsL72:QUpNSBebAChkGYNOLIS4j8
                                                                                                                                                                                                                                                                                            MD5:91F34F05FA16841B14854656F7E13E70
                                                                                                                                                                                                                                                                                            SHA1:46E57E2B5894D63FFFC7D2B71C3C98E43AE5F81A
                                                                                                                                                                                                                                                                                            SHA-256:B217344606FAA1CDFDB5581472743E4C994C132FDB125C271FB3B8F464ECF7C1
                                                                                                                                                                                                                                                                                            SHA-512:1F41B674005AC6EC784A9C3AD6480CFD1507D84B263E23F0ACFE7CF8AF2E6A4164BD0C4EE40813A2166D1BDC77A847BA3F53E0A54E27DC0275E81086676D09DA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........'..e.....g.6...h.;...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.<...y.c...z.....|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....X.....n.................-.................>.................7.....F...........I................./.......................T.......................P.......................S.............................!.....j.................s.................'.......................P................. ............ ....^ ....x ..... ....*!....G!....^!.....!....."..../"....A".....".....".....#.....#.....#.....#.....$....3$.....$.....$....+%....=%.....%.....%.....&.....&.....&.....&....!'....4'.....'.....(....=(....Q(.....(....F).....).....).....)....9*....T*....h*.....*.....+....*+....I+.....+.....,....<,....R,.....,....2-....s-.....-.....-....P.....k.................b/...../...../...."0.....0.....0.....0....M1.....1.....2.....2.....2....-3....w3.....3.....4....{4.....4.....4.....5....p5.....5.....5.....6.....6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\da.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):512351
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.476004323210556
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:1WHszyfdU8zVWGImBsdhzqWId4h7qwvzZhMqEyi/3e74F7Dew9eu2s3ERaruGd0r:1jyf7I7dhd4qEyiW4eu5N6GI
                                                                                                                                                                                                                                                                                            MD5:0010B88F465453E03C3665457A3E6818
                                                                                                                                                                                                                                                                                            SHA1:3ABCC9F2540C416D3CEAEFB8173590D19233A63B
                                                                                                                                                                                                                                                                                            SHA-256:31A6DA6F37AF910B2A4BFF2B2A50217271699D075EDF832FF397E8246720F09E
                                                                                                                                                                                                                                                                                            SHA-512:AC736AE0A6A15637FDE57E573F6398D4B04CAA6CF2B78B11462C881F3C3CFD6D8203DCA38C9A61952C1C34369082740CDB029FBFA6BE7313CD392C850F99530A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.7...t.N...v.....w.....y.....z.....|.+...}.\...............................................................................................z...........3.....C...........%.....a.....y.............................R.......................R.......................8.......................5.......................]...................................D.....W...........,.....d.....x.............................~...... ....V ....| ..... ..../!....Y!....k!.....!....."....6"....D".....".....".....#.....#....}#.....#.....$....'$.....$.....$.....%....(%....|%.....%.....&.....&....`&.....&.....&.....&....B'.....'.....'.....'....N(.....(....#)....;).....).....).....*..../*....y*.....*.....*.....+....T+.....+.....+.....+....Q,.....,.....,....3-.....-.....-..........&.................#/....8/...../...../....#0....90.....0.....1....[1....i1.....2....z2.....2.....2....F3.....3.....3.....3....24.....4.....4.....4.....5....p5

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\de.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):556005
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.5093479730116615
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:yYhYPD0gcoBkgPZ4wXI7eMvUvTzUCmPzKpYWp/6CC9QS0SBJ9ShlpyV:1h1gccxxMvUkCm77CC9FS8V
                                                                                                                                                                                                                                                                                            MD5:90EFBE0DF09AC842922AB21BC3F90BF2
                                                                                                                                                                                                                                                                                            SHA1:7D03BB08CF6FD4F250489063FB2D9D8F5775490E
                                                                                                                                                                                                                                                                                            SHA-256:03081B7E6678241D75B4ED3D13298A7979F5ED349900DDAFD8C02BF27A0A8B88
                                                                                                                                                                                                                                                                                            SHA-512:E69EE112D2CE723A97F74261C8A781F05437865C16DD570D5E60D18A72AC5D279A8EAECC5CD7117982EBBD56C8C4B67D94DECA91C56DE507F98771371ABBCDD2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........'0.e.....g.....h.....i.....j.....k.....l.....n.....o.....p. ...q.&...r.2...s.a...t.x...v.....w.....y.....z.....|.U...}...........................................................................................5.........................................\.....q...........i.................J...................................-.....>...........(.....[.....o...........u.................^........... .....B...........C.....}...................................w...... ....] ....w .....!.....!....."....-".....".....#.....#....C#.....#.....$....F$....X$.....$....-%....W%....h%.....%....u&.....&.....&....B'.....'.....'.....(....t(.....(.....)..../).....).....*....G*....V*.....*....H+.....+.....+....',.....,.....-....*-.....-..........).....@................../....#/...../...../.....0....20.....0....J1.....1.....1.....2.....2.....2.....2.....3.....3.....3.....3....i4.....4.....5....+5.....5....96.....6.....6....&7.....7.....7.....8.....8.....8....)9....>9.....9.....:....;:....J:.....:....I;

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\el.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):953330
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.869357856211871
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:sa0TnjNCRR9PJcn/OIL+pDnfEybmvD7XroZe+ylmJP/p6YDMnWbIz+9dqN61yvo0:70TnjNCRR9PJcn/OIL+pDMybmvD7Xrom
                                                                                                                                                                                                                                                                                            MD5:FF8318EB168D63C866D912FFA3132A49
                                                                                                                                                                                                                                                                                            SHA1:F9B93E5DC46E19CF445B5474FF2258FB08D04B63
                                                                                                                                                                                                                                                                                            SHA-256:D3BBA7E5D87F0E0D582B148D9520F0C1F7092765C376935F09363756EA2C370C
                                                                                                                                                                                                                                                                                            SHA-512:3CCDE1EBD5E4CA995A1A2A38C009880F82268538500A8319ABE4C67593BE70D4F49231ABB4E51D67DA65B7052CA57E6E6558C2D7CD4AB0EB802B2110B922CDF5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........'..e.^...g.f...h.k...i.s...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.>...w.j...y.....z.....|.....}.......@.....E.....M.....U.....].....d.....k.....r.....s.....t.....v.......................M.....u.....l...........N.....I...................................c.................N.......................Z.................v...... ....U ....u ....D!....."....c".....".....#.....$....3%....m%....?&.....&....~'.....'.....(....<).....).....).....*.....+.....,....;,....o-....g....../....T/.....0.....0.....1....,1.....1.....2.....2.....2.....3....G4.....4.....4.....5....x6.....6.....7.....7.....8.....9....-9.....:.....:....<;....c;.... <.....<....2=....Y=.....>.....>.....?....O?....Z@....bA.....A....0B.....C.....C....,D....aD.....E.....E.....E.....E.....F....3G.....G.....G.....H....dI.....I....8J.....J.....K.....K.....K.....L....wM.....M.....N.....N.....O....,P....[P.....Q.....R....VS.....S.....T....wU.....U....1V....AW....=X.....X.....X.....Y....tZ.....Z.....[.....\.....]

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\en-GB.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):450401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.5355876335635426
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:aNchTD5PsjF8+Wix9BcBRBuvBLvnk0daP6d91V/3:mchXqSAxNZbSP67/3
                                                                                                                                                                                                                                                                                            MD5:D7A527E9B2BBEC67CF52A5CFD5CD5F70
                                                                                                                                                                                                                                                                                            SHA1:F9D5EA4645B81471012A8D69BBEA1E11A7FD931A
                                                                                                                                                                                                                                                                                            SHA-256:70B8E17992AC448B8761921789CA95EBFF88EABF66AE90DCBA4ADBC1923F246E
                                                                                                                                                                                                                                                                                            SHA-512:9A8B125D0C2F31270F04C894072B7965F13498F70D529731ED13A6423AE4BF428D9C83E5A93A7BE914C09F4344F50AABDD7A1249F5BB1193F8F10A3774A8FC8A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........R(..e.....g.....h.#...i.1...j.=...k.L...l.W...n._...o.d...p.q...q.w...r.....s.....t.....v.....w.*...y.Q...z.....|.....}.....................................$.....+.....2.....3.....4.....9.....F.....X.....h.....y...........O.......................O.......................P.......................G.....v.......................F.....T.............................f.......................I.......................?.............................b.......................1.....].....h...........1.....s.............................'.....e.............................H.....i.....u............ ....O ....b ..... ..... ....&!....2!....{!.....!.....!.....!....<"....."....."....."....."....A#....j#....u#.....#.....$....k$.....$.....$.....%....0%....F%.....%.....%.....%.....&....N&.....&.....&.....&.....'....d'.....'.....'.....(....;(....V(....e(.....(.....)....=)....M).....).....)....**....B*.....*.....+....]+....k+.....+....+,....b,.....,.....,....!-....M-....\-.....-.....-................r.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\en-US.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):452848
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.5368148743109185
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:AWGMyyu9cVzW1i3u00xungIs/0bYwfy3v3eSy+x6O9wH/l:AWGMyyicVzWs4x+YwK/Jx6h/l
                                                                                                                                                                                                                                                                                            MD5:D33021C19857ED4E0FA117CFF25E5817
                                                                                                                                                                                                                                                                                            SHA1:3539769832CA53FF99150C62933DCD30C55CEA3D
                                                                                                                                                                                                                                                                                            SHA-256:1B84631A6B7405396B228A72EBE4EF84FE39451C20B37E63259E78DF82B44138
                                                                                                                                                                                                                                                                                            SHA-512:B1A0CAAF87BF7B0D3DC5630FFF9E51BCA4B7885BD644D701C044EA85C29785FCD7608DD84D944D38F14A82795991B0F8F8220E4769DF9D60CFB53A791F2A95A6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........r(f.e.V...g.^...h.c...i.k...j.w...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.8...w.d...y.....z.....|.....}.......:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....s.............................%.......................=.......................2.......................5.............................U.....~.......................?.....L.............................|.......................n.......................J.............................`.......................`.......................,.....G.....V.............................:.....w.......................L ....~ ..... ..... ....(!....U!....a!.....!.....!....."....#"....k"....."....."....."....+#....p#.....#.....#.....$...._$.....$.....$.....%....?%....b%....x%.....%.....%.....&....3&.....&.....&.....&.....&....R'.....'.....'.....'....9(....p(.....(.....(.....(....9)....c)....s).....).....*....P*....h*.....*....9+.....+.....+.....+....L,.....,.....,.....,....B-....n-....}-.....-..........$.....4.............

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\en-VO.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):455060
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.546780078300041
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:FyP1FM4jaoOc00xungfs/0bIw0QhzLD+/0c6d9ZcLE:FyPP/aWxHIwnN3c6eLE
                                                                                                                                                                                                                                                                                            MD5:FBB6149114113241362832ED2ED64034
                                                                                                                                                                                                                                                                                            SHA1:9F20153329FB14727AF00709377C0125B26509EE
                                                                                                                                                                                                                                                                                            SHA-256:AC4EC18A97A393F9AED43484E5CC2719FAF6DC6836D3A3DC7596326AB95B901A
                                                                                                                                                                                                                                                                                            SHA-512:D5EC659F610B8BF51CB21B0D7C6AE9D9BEBAF84D452AB8551820A543DE325E1ADE2A3D110B4DFEBF480FD84CB400896AB24707E27D0CEAE6B4BA87BE58808061
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........o(i.e.P...h.c...i.k...j.w...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.8...w.d...y.....z.....|.....}.......:.....?.....G.....O.....W.....^.....e.....l.....m.....n.....s.............................%.......................=.......................2.......................5.............................U.....~.......................?.....L.............................|.......................n.......................J.............................`.......................`.......................,.....G.....V.............................:.....w.......................L ....~ ..... ..... ....(!....U!....a!.....!.....!....."....#"....k"....."....."....."....+#....p#.....#.....#.....$...._$.....$.....$.....%....?%....b%....x%.....%.....%.....&....3&.....&.....&.....&.....&....R'.....'.....'.....'....9(....p(.....(.....(.....(....9)....c)....s).....).....*....P*....h*.....*....9+.....+.....+.....+....L,.....,.....,.....,....B-....n-....}-.....-..........$.....4................../

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\es-419.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):546021
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.38654398567322
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:SxndFaP3psG7CcTU+uIQJ0mhub1jEYp4cwqyyfG2vIQz3YOir1VKr4:Ua5VC5+SrJcwqyRdDKE
                                                                                                                                                                                                                                                                                            MD5:258CBF56876EE16AE626A6503497AF7B
                                                                                                                                                                                                                                                                                            SHA1:8B94B979C3AC2B05F761AE1AB98012C345A2C288
                                                                                                                                                                                                                                                                                            SHA-256:423F0AE1628245D3FE70DFF4FA4D1AE47DE3583E30532880245BFA1C6699A543
                                                                                                                                                                                                                                                                                            SHA-512:0C866AEF7197C8192B2265649212D478FA9546C103A07FE13B9F5FD85027CDA278DED45FDD324907C9D98AD52AF5ADD0C19E3C7461135BD40355819D653E217A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........4(..e.....g.....h.....i.....j.....k.....l.....n.....o.#...p.0...q.6...r.B...s.q...t.....v.....w.....y.....z.>...|.e...}.....................................................................................1.....H...........y.................l.................0...........@.................7.......................[.......................I.......................m.................O...........E.................'.......................Z.............................. ....I ....d ..... ....{!.....!.....!....M"....."....."....."....2#.....#.....#.....#....)$.....$.....$.....$....C%.....%.....%.....&....h&.....&.....'.....'....i'.....'.....'.....'....O(.....(.....(.....(....G).....).....).....).....*.....*....=+....^+.....+.....,....G,....g,.....,.....-....A-.....-..........A.....Q...........F/...../...../....60.....0.....0.....0....,1.....1.....1.....1....P2.....2.....2.....3.....3.....4....{4.....4....%5.....5.....5.....6.....6.....6....<7....P7.....7.....7.....8.....8.....8.....9....Z9

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\es.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):541888
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.374805625410166
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:DwsDyER12ljsCB2UW/rVU0k8+6PZa/wYF+XgK+Tf8QyMvTKnbzb157jTULBa0H9:Z2b2T/rV44YgU8QyV7jMo0H9
                                                                                                                                                                                                                                                                                            MD5:32A4A9D464530AC53DD0564477026178
                                                                                                                                                                                                                                                                                            SHA1:4EC5DE2FB80B701526CD11C19C98D9B1C5E0E77F
                                                                                                                                                                                                                                                                                            SHA-256:07C496CF36AA46E8DCD52C0C2A86FA6EB516295222BAB11D9C1500FE3967CC89
                                                                                                                                                                                                                                                                                            SHA-512:8BC7C33E3362018B1CC6AC73050542F4C00F47CB0E2C3A787E46AB7C5A70B826F3D476B1DA5ED3A132C4CD366C514CC557054EC58FCE6804ACE689E217228F03
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........,(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.%...r.1...s.`...t.w...v.....w.....y.....z.-...|.T...}.....................................................................................!.....9...........k.................Y.................*...........L.................7.......................V.......................T.......................{...........2....._...........Y.................%.......................O...................................@ ....Y ..... ....g!.....!.....!....:".....".....".....".....#.....#.....#.....#.... $....~$.....$.....$....;%.....%.....%.....%....5&.....&.....&.....&....%'....~'.....'.....'.....(....c(.....(.....(.....)....Z).....).....).....*.....*.....*.....*....J+.....+.....+.....+....E,.....,.....,.....,....X-.....-.....-.....-................;/....u/...../....#0....G0...._0.....0....!1....O1....b1.....1....12.....2.....2....'3.....3.....4...."4.....4..../5....~5.....5....!6.....6.....6.....6....17.....7.....7.....7....&8.....8

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\fi.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):507168
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.458183798218779
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:C03GA119SHFJpFnWp0WaYrhYYb7uZ5sl+Y5ylDttOaMc1JQ:C9Pnct8Ve
                                                                                                                                                                                                                                                                                            MD5:894A5ECB725BB7498965C75FABDD6086
                                                                                                                                                                                                                                                                                            SHA1:BABAC82221954E702613D84BEB2DE000A9C79617
                                                                                                                                                                                                                                                                                            SHA-256:849706977C23264AD6BCD3474EB59FAE915C0220176820E11852349858A8F768
                                                                                                                                                                                                                                                                                            SHA-512:24CB805949E28A988423AD168BE00D68CE07ECEC1367635FBC3563E87DCC1B730CABE6A26517BB22FA399C6F6CD2314613239ADA2004F65A2DD40C317B925745
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........'..e.....g.....h.....i.....j.....k.%...l.0...n.8...o.=...p.J...q.P...r.\...s.....t.....v.....w.....y.*...z.X...|.....}.........................................................................$.....7.....J.....c...........g.................6.......................H.......................o.................".....y.......................W.......................-.....|.................4.......................Y.......................U.......................X.......................x...........0.....F.............................{.......................I ..... ..... ..... .... !....s!.....!.....!.....!....W"....."....."....."....2#....[#....f#.....#.....$....E$....U$.....$.....$.....%....)%.....%.....&....P&....h&.....&.....&.....'....-'.....'.....'.....'.....(....y(.....(.....(.....)....w).....).....*....9*.....*.....*.....*.....*....K+.....+.....+.....+....L,.....,.....,.....,....o-.....-....<.....Q............/....N/....j/...../....%0....T0....f0.....0.....0.....1.....1....o1.....1

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\fil.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):566105
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.28867533116167
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:hHbiUsXAAnXkWCw4Y7rCoX4sxZD5u/lyV6CWrKG6:F2UsXAGki7jmM6tKh
                                                                                                                                                                                                                                                                                            MD5:A6BFF7BEADC3EFD72C2E8BC7EE77219B
                                                                                                                                                                                                                                                                                            SHA1:811384D0C12BA4447CFDDFD51E5927A33F397D01
                                                                                                                                                                                                                                                                                            SHA-256:2B03126E22171960C989F327F6DBA2505E6773516C5121874B3E0962364D387F
                                                                                                                                                                                                                                                                                            SHA-512:AA2BCFE0046CDA76BD198405E83BD80A2534E18FD6361047D83FCBE3FA28CC32D87675AF79BB88C553D30D819FF992FC111487CAA57E7F98B381DA196F6BFE89
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(=.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.L...t.c...v.....w.....y.....z.....|.@...}.q.........................................................................................+...........a.................Y.................0...........e.................f.................;.................0.....?.................I.....\...........\.................\...........-.....T...........F.................. ..... ..... ..... ....b!.....!....("....?"....."....f#.....#.....#....E$.....$.....$.....$....=%.....%.....%.....%....$&.....&.....&.....&....)'.....'.....'.....'....K(.....(.....(.....(....W).....).....).....)....Y*.....*.....*.....*....Z+.....+.....+.....,....~,.....-....Q-....n-.....-....4.....`.....~............/....</....R/...../.....0....I0....c0.....0....X1.....1.....1....>2.....2.....2.....2....W3.....3.....3.....4.....4.....5....O5....r5.....6.....6.....7....#7.....7....48.....8.....8....*9.....9.....9.....9....>:.....:.....:.....:....S;.....;

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\fr.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):578092
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.412161366125114
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:iFzZ19OiEQ/hLRgaC6HQsn6IfSGKGsa5iZpMMYnYCo59x3zz7IFGA2MQtBXJRChX:iBphGCGA2MmTA
                                                                                                                                                                                                                                                                                            MD5:0698169E203DC2583BF6BE3EA0106FCD
                                                                                                                                                                                                                                                                                            SHA1:5B86F371FF75F589362345DEB82C07860383C11D
                                                                                                                                                                                                                                                                                            SHA-256:4BDC592567F01558049B4BDF3FB27DFB13B7029FEE155D7BCC74C83B46F02892
                                                                                                                                                                                                                                                                                            SHA-512:30E7C0A0C5492E5A71DFED0AC6F357B7C151323DB72644056E0E011DD6DAE0707AB4062EBB2D28C3657C59D4990776150C1ACDF8D06D111C36CE96C96B7AC7C3
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.K...t.b...v.....w.....y.....z.....|.?...}.p.....................................................................................................Y.................S................. ...........>.................&.......................^.......................c...................................U.................n.................@.......................k.................,............ ....Y ....r .....!.....!.....!....."....t".....".....#.....#....u#.....#.....#.....$....o$.....$.....%.....%.....%.....%....%&....=&.....&.....'....:'....O'.....'.....(....-(....;(.....(.....(.....)....)).....).....).....*....3*.....*....6+.....+.....+.....,....u,.....,.....,.....-....Y-....y-.....-.....-....`.................Q/...../.....0....G0.....0.....0.....1...."1.....1.....2....J2....f2.....2....R3.....3.....3....A4.....4.....5....%5.....5.....6....\6.....6.....7.....7.....7.....7....O8.....8.....8.....8....b9.....9

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\hi.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1157356
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.417961134049782
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3072:h+9DYfjxkCI7Kqph9rTRY/V/BB0ZV1d1Y/6OxEIOG8Ut0bJ2cME/uQYVWmhdYyBT:AW9w5/NXKaiXorM
                                                                                                                                                                                                                                                                                            MD5:216D75120223B970986D4CA320AB11C3
                                                                                                                                                                                                                                                                                            SHA1:ACB826DAB628069162A1849B24A4AEF34BE77A4E
                                                                                                                                                                                                                                                                                            SHA-256:F8282A4A55640BC728FED079F057CF3488C2B53B9EE6DBDBFCE7DCDA12DD77B3
                                                                                                                                                                                                                                                                                            SHA-512:BADA0239FEA2CB64E0559C5B957598FC2749F7B355C421BE05BEE0EC28291CD2BB417901936EEB830C878DA267908428F852A18CCCAC08874C9D19027EDB8FBF
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........0(..e.....g.....h.....i.....j.....k.....l.....n.....o.#...p.0...q.6...r.B...s.q...t.....v.....w.....y.....z.>...|.e...}...............................................................................B.....m...............................................a.............................2.....%.............................0 ..... ..... ....x!....."....s"....."....}#....%$.....$.....$.....%.....&....2'....~'....X(.....).....).....).....*....Q+.....+.....+.....-.....-....~............/.....0.....1.....1.....2....s3.....3.....3.....4....\5.....5.....5....m6.....7....G7....`7....78.....8....\9.....9....L:.....;....^;....};....-<.....<....-=....I=.....=.....>.....>.....?.....?....|@.....@.....@.....B.....B.....C.....C....rD.....E....jE.....E....1F.....F.....F.....G.....G....hH.....H.....I.....J.....J....;K.....K....IL.....L.....M....WM....KN....'O.....O.....O.....P.....Q....<R....tR.....S.....U.....U....%V....3W.....X.....X.....X.....Z.....Z....x[.....[.....\.....].....]....4^....1_....._

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\hr.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):540246
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.542254436366335
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:rvi0+kV6qzGwxevYt/cgzChtwRm2T8CWKF:r6/gT6wxWYpbEwRm+LV
                                                                                                                                                                                                                                                                                            MD5:5D0A4C69C534AD05879E6E3E7C535039
                                                                                                                                                                                                                                                                                            SHA1:E50163AB3EEA2FC46C487F628B5D17A2FDA8B6F4
                                                                                                                                                                                                                                                                                            SHA-256:AE5FC94C3B823586FFB920E86F1223C2CA534C0A68C88079C31EC6FB5C63F864
                                                                                                                                                                                                                                                                                            SHA-512:EE5795EF7777F6696A1B2FC08DD18B989DF9C8C07E437F2FD1DB5E19F9302BB8540E65F41FD7FC7B1F4551884C485D36C7584A385092F1561B00B23467F86C20
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........P(..e.....g.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...|.....}.....................................#.....*.....1.....2.....3.....5.....A.....O.....].....n...............................................1...........(.....u.................h.......................t.......................[.......................g.................D.................1.................A.....Y.................T.....h...........P.................J ..... ....7!....Z!.....!....."..../"....K".....".....".....#.....#....[#.....#.....#.....#....9$.....$.....$.....$....=%.....%.....%.....%....<&.....&.....&.....&....='.....'.....'.....'....!(....y(.....(.....(....1).....).....).....*...._*.....*.....*.....*....I+.....+.....+.....+....',....z,.....,.....,....;-.....-.....-..........p.......................k/...../...../.....0.....0.....0....E1....b1.....1....n2.....2.....2....W3.....3.....3...."4.....4.....4.....5....%5....y5.....5.....5.....5...._6.....6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\hu.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):578397
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.657006930558387
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:24rP1s6he0QiNdHRAxAGKXtxB/ekMH9svQdpE8/3ICKHlV++kithO5qizTZ9pA7A:24rq6Um/j5MdkrO5qiz2X2lIC
                                                                                                                                                                                                                                                                                            MD5:065C48AD543FF72CFFB5ACF3099750E9
                                                                                                                                                                                                                                                                                            SHA1:07A2A95557F836DE9B5EA1055EABEE4488B4AB9C
                                                                                                                                                                                                                                                                                            SHA-256:955443F35F23E56EB87A96B145DD10E946C38AFC5091F10FD693684168ED2775
                                                                                                                                                                                                                                                                                            SHA-512:F5BF6E82CD7306C3B8F7A2CF8A2CAC6848A65C7B3E02982BA0F1D167B092CE0882B32B8890E002B9851730E0BD96154756D02830B90A479434DECD5398B213C9
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........'..e.0...g.8...h.=...i.N...j.X...k.g...l.r...n.z...o.....p.....q.....r.....s.....t.....v.....w.E...y.l...z.....|.....}............. .....(.....0.....8.....?.....F.....M.....N.....O.....T.....d.....|.................Y...........z...................................k...........Q.....k...........c.........................................-...................................2.....c.............................x...........-.....?...........&.....h.....x...........{ ..... ..... ....p!.....!....\"....{"....."....o#.....#.....#.....$.....$.....$.....$.....%.....%.....%.....%....v&.....'....R'....i'.....'....s(.....(.....(....C).....).....*....0*.....*.....+....\+....q+.....+....w,.....,.....,....H-.....-....-.....C...........'/....N/....j/...../....50....a0.....0.....0....Q1.....1.....1....92.....2.....2....+3.....3.....3.....4.....4.....4.....4.....5...."5.....5.....6....h6.....6.....7.....7....*8....98.....8....`9.....9.....9....x:.....:....?;....[;.....;....)<....Z<....v<.....<....g=

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\id.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):490240
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.4117296168679525
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:oxi5w/pfR9xowosnVMsJunEOplOBHtmyH1112ZIIIpLftEB:v5AfhhXnVMLEOpy1WZIIUt4
                                                                                                                                                                                                                                                                                            MD5:D84BBD94A0E709084BA1C2EBE8A57932
                                                                                                                                                                                                                                                                                            SHA1:ED752102CF8BE6E3EE322FF80DAA97FE975698AE
                                                                                                                                                                                                                                                                                            SHA-256:2A0DB41DE53C848A610FE913AB37D141166B20922A77FF243CA28A2C244A4574
                                                                                                                                                                                                                                                                                            SHA-512:0E3C4DF992B5894C72B0C36114B209640D1D983081DAC7D5638D51382CD1DC099C9EB825E8EA59B335DDEB37DB053F15F2153A25FE2039DED9C1417A37B95B61
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.A...t.X...v.....w.....y.....z.....|.5...}.f...........................................................................................................5.....L.......................'.................1.....I.................A.....U.................3.....F.............................z...............................................v.......................P.......................D.......................c.................#.....j.............................f.......................0 ....Y ....c ..... .....!....B!....Q!.....!.....!....%"..../".....".....".....".....#....X#.....#.....#.....#....:$.....$.....$.....$....)%.....%.....%.....%.....&....O&....j&....{&.....&.....'....+'....C'.....'.....'.....(....((.....(.....(.....(....!)....i).....).....).....)..../*.....*.....*.....*.....+....x+.....+.....+....M,.....,.....-....--.....-.....-....1.....M.................,/....:/...../...../...../...../....Z0.....0

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\it.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):540878
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.312777993920032
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:YQMkMtdc17FvXJqILfMsFK5kG+baqw7rBkPI4Pyy5kxAjVTdB5mY+IzMuZLNzubR:YpptyVJTPIODtyZTE8eVrH69h
                                                                                                                                                                                                                                                                                            MD5:D98E901C594772E1CD2A63D0CCF55DA5
                                                                                                                                                                                                                                                                                            SHA1:F18C4E8D21A99FBE565AFE96CF8A5D01C0F4EF66
                                                                                                                                                                                                                                                                                            SHA-256:5E53DE76B3AD9050AA4E7B5DFCCAC743FC5CA2AF2BA72E3D7A4065906EA242D8
                                                                                                                                                                                                                                                                                            SHA-512:939D2ABC3D0F3E3A0EC8DED40CF388648218D9ACB7035B07F41876373BD3E2AC30C0869F6C9E7041B602E6225B7BBD0F6607771852FA31982B024DBFD7419BE2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.1...t.H...v.}...w.....y.....z.....|.%...}.V...................................................................................................../.......................y.................S...........,.....H...........=.......................I.....p.....~.................E.....T...........0.....m...................................y...........".....3.................-.....C.................`.....y...... ....s ..... ..... ....H!.....!.....!.....!....."....x"....."....."....."....A#....h#....s#.....#....=$....}$.....$.....$....8%....k%....v%.....%.....&....A&....J&.....&.....&.....'.....'....r'.....'.....'.....'....{(.....(....4)....M).....).....).....*....2*....v*.....*.....*.....*....:+.....+.....+.....+....I,.....,.....,....&-.....-.....-.....-.........._.......................k/...../.....0....90.....0....P1.....1.....1....]2.....2.....3....?3.....3....,4....x4.....4.....4.....5....=5....P5.....5.....6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\ja.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):648456
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.832446841821655
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:3L+rl8Z+bMJa3NWRVHXqwdlvQFtzGaK3u:3LYlueVNnwdlvszzK3u
                                                                                                                                                                                                                                                                                            MD5:68A347A9EC0337E85B33CD384979EDB9
                                                                                                                                                                                                                                                                                            SHA1:97BD524B956017F93CBFE894856A65804ED6830B
                                                                                                                                                                                                                                                                                            SHA-256:FC6DA392E61DF3536ABB72082E54526567B42A97A7EF88D371763CF715DE4939
                                                                                                                                                                                                                                                                                            SHA-512:9127B1A75C4B29F6AA281B359F170B559033FC2087CB627046D8211246E55508909FB6CFFEA546E547A724784DD1979541CF58601E7F1F7C61CD35E11B891874
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Y'..e.$...g.,...h.1...i.<...j.E...k.t...l.....m.....o.....p.....q.....v.....w.....y.:...z.h...|.....}.................................................%.....,.....3.....:.....<.....A.....Z.......................Z...........;.....Y...........O.................?...........".....=.......................J...........:.....k.....}...........K.....x...................................r...........6.....W...........7.....j.....z...........U.......................v.................e .....!....g!.....!.....!....F"....h".....".....#.....#.....#.....#....s$.....$....;%....\%.....&.....&.....&.....'.....'.....(....d(....s(.....(....o).....).....)....9*.....*.....*.....*.....+.....,....N,....c,.....-.....-.....-................./....J/....l/...../....Q0.....0.....0....)1.....1.....1.....2.....2.....3....\3.....3.....3....N4....p4.....4.....5.....5.....5.....5....Y6.....6.....6.....7.....7....K8.....8.....8....`9.....9.....:....O:.....:....c;.....;.....;....I<.....<.....<.....=.....=.....>....f>

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\ko.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):545438
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.174986897079794
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:QmDwwO7dqrQh9K51kpUB1RrOejLUkPGkist4TxRScG0G1zRXhwvTqog5XdKV2nAJ:XYKmILGt
                                                                                                                                                                                                                                                                                            MD5:862E55384D3C35AF76CA1011E2F8763F
                                                                                                                                                                                                                                                                                            SHA1:1B82E5BCC9AB29EA7EC0119F61E54D884D6279AD
                                                                                                                                                                                                                                                                                            SHA-256:BB8D4AADA0582AFF54A49D4C975352F78D53A14A6C32C039650F89CE1A5308BB
                                                                                                                                                                                                                                                                                            SHA-512:4FEF1BA6BDE14E0B008B4A06286F5B9FF7510C96ED871301CFF466E5925F84F7C1ABF283682F0D7754413F74012DA668766BE2409D80934BA73EB4855DE9D818
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........8'..e.....g.....h.....i.....j.....k.7...l.?...m.G...o.n...p.u...q.{...r.....s.....t.....y.....z.0...|.W...}...................................................................................../.....?...........2.....{.................r.................<.......................m.................*.......................-................. .....3.................#.....>.................Q.....e........... .....N.....[.................>.....K.................U.....e...........h.................1.....~......................._.......................: ...._ ....o ..... ....S!.....!.....!....."....q".....".....".....#....|#.....#.....#....&$.....$.....$.....$....#%....}%.....%.....%....A&.....&.....&.....'....t'.....'.....'.....'....d(.....(.....(.....(....o).....).....).....).....*.....*....-+....]+.....+.....+.....+.....,....y,.....,.....,.....-....|-.....-.....-................./....R/....`/...../....90....j0.....0.....0....I1....x1.....1.....1....>2....^2....q2.....2....33....b3....u3

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\lt.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):577279
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.652915201219278
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:EtI0CT86PNvL7Wbn+7KIGuJiQbl2RnYVR9OZ6S+2IC5Cya566x0+rEROiI2A:oItT869lGsiQbfVR9e6ShQya550xTI2A
                                                                                                                                                                                                                                                                                            MD5:10F11FB434B1F7F6E91B6B47EE6058F0
                                                                                                                                                                                                                                                                                            SHA1:DEF0CFAA513305E33C4B498FB513AF345CCE75BB
                                                                                                                                                                                                                                                                                            SHA-256:DAA2E97BF747CF404D697C081D64516DF3377D43E063C27FC944D85E1F3097CA
                                                                                                                                                                                                                                                                                            SHA-512:11E03D61211FFE4411E259F8E60E76C5348507C28178E5E49A7D955D323FFAA8A628224716AC8E0BEED2B5D2A91A2993566F8A383F585A37A79C59EB3883CF17
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.G...t.^...v.....w.....y.....z.....|.;...}.l.....................................................................................................\.................X.........../.....G...........k.................P...................................O.....^...........Z.................)...................................V.....p...........`.........................................s ..... ....;!....T!.....!....y"....."....."....P#.....#.....#.....$....v$.....$.....%.....%.....%.....&....M&....b&.....&....\'.....'.....'.....(.....(.....(.....(....e).....)....!*....2*.....*....6+....j+....{+.....+....b,.....,.....,....>-.....-....*.....H............/....[/....{/.....0.....0.....0.....0....k1.....1.....2.....2.....2....<3....}3.....3.....4.....4.....4.....4....Z5.....5....%6....;6.....6....S7.....7.....7....`8.....9....\9....t9.....9....}:.....:.....:....y;.....<....R<....c<.....<....$=....C=....X=.....=....l>

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\lv.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):575627
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.658825803991528
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:C8aPFYnAujgY1rR28cXPS03RIFn/dTRT53ePqrkRIbXMPKUj0rNMtVFLdyuREodW:Ja9mlJFn/dTB5xriPKUjl86P+
                                                                                                                                                                                                                                                                                            MD5:78FF9AB1A8F2A1B1815A17874C973A38
                                                                                                                                                                                                                                                                                            SHA1:E451E942FD42F5E603462A0B3D50D23D70DC97B6
                                                                                                                                                                                                                                                                                            SHA-256:027E29A4C70C3F937256B9521A10FEE8FFC30CD9E54B82E7B2AE5A274F85874E
                                                                                                                                                                                                                                                                                            SHA-512:3236D51C12E15AFDAA4B231B9F46C4A061E4AD9DB77E61E71E6EC7DE119C248C8AA35D13C803537D482940A56D3EA3479092973B8A0D3CF9F9062AA54365887C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........B(..e.....g.....h.....i.....j. ...k./...l.:...n.B...o.G...p.T...q.Z...r.f...s.....t.....v.....w.....y.4...z.b...|.....}.........................................................................,.....F.....\.....x.................!.....=...........7.....q.............................%...........5.....v.................t................. .......................l.................=.............................e...........5.....K...........C ....| ..... .....!.....!.....!....."....."....G#.....#.....#.....$.....$.....$.....$.....%.....%.....%.....%....$&.....&.....&.....&....R'.....'....+(....A(.....(....&)....W)....i).....)....W*.....*.....*.....+.....+.....+.....+....8,.....,.....,.....-.....-....@................../....m/...../...../.....0.....0.....0.....0....R1.....1.....1.....1.....2.....3....W3.....3.....3....^4....~4.....4.....5.....5.....5.....5....g6.....6....+7....B7.....7.....8.....9.....9.....9.....:....R:....x:.....:....s;.....;.....;....%<.....<.....<.....<....Q=.....=

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\ms.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):505996
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.3055475514178365
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:BpAeoPYOPW3t+miqEyGC90WLslwxMikqedePR9G:B+ewJPW9+qbGCSwxdP5Q
                                                                                                                                                                                                                                                                                            MD5:1AFB97C63650B4B3E7C5BC58835B1CEC
                                                                                                                                                                                                                                                                                            SHA1:75CFD2A3150C3A7BFD0FC721039A18387F912EA4
                                                                                                                                                                                                                                                                                            SHA-256:FC7F0D25C6AC7D8F3708DB3667AA1A30E027527587F27759A3E1E90C5B0EC08F
                                                                                                                                                                                                                                                                                            SHA-512:4826AD94E2F84F64D7BEBBA9661DC835C18EA6B927D44BFE1165318F05FC4A5E59B06A6EE346F05661FF4E4656DA21788EE628AB4EC6268B4F7494F678508C9C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.*...t.A...v.v...w.....y.....z.....|.....}.O.....x.....}...............................................................................................p.................J.....~.................l.................3.......................M.......................C.......................E.......................k...........$.....<.............................i.......................W.......................t...........A.....S........................ ....] ..... ..... ..... ..../!.....!.....!.....!....."....}"....."....."...."#.....#.....#.....#.....$....{$.....$.....$.....%....i%.....%.....%.....%....\&.....&.....&.....'....}'.....'.....'....,(....~(.....(.....(.....)....^).....).....).....)....;*....d*....u*.....*....$+....Y+....|+.....+.....,.....,....(,.....,.....,.....-....)-.....-.....-....7.....P...........G/...../...../.....0....x0.....0.....0....11.....1.....1.....1.....2....U2....w2.....2.....2....53

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\nb.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):494313
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.4612959381116655
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:iPOyr54zcebpbjr2fJHNg4pQhSughKPYA3g2YqRzAxLp+xQVLhS6eC5:ivr561bjrmJVqwughOYugoRUxLVLjeC5
                                                                                                                                                                                                                                                                                            MD5:6E65DAE7DDE0AE4C73EB566EC747CC4E
                                                                                                                                                                                                                                                                                            SHA1:45F6EF95AE7A3E95B750A17682D69016252574BC
                                                                                                                                                                                                                                                                                            SHA-256:E74966323E438712E20564948CD911D11167EBC419216491BB7D53C2CD7FB110
                                                                                                                                                                                                                                                                                            SHA-512:885D1702EE3E84334A720EB6813399EBFAEA11323E813CE3B9D1002CEE26C4B694DF94C220FDF0004B6A611C8B29C4A4DF6D3CBEE82DED19C262E6F30E6C16ED
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.=...t.T...v.....w.....y.....z.....|.1...}.b...........................................................................................................o.................M.................%.......................y.................!.....z.......................h.......................i...................................:.....]...........j.................D...................................E....._............ ..... ..... ....>!.....!.....!.....!....."...._"....."....."....."....B#....g#....w#.....#....>$....v$.....$.....$....J%....x%.....%.....%....P&.....&.....&.....&....E'....n'....~'.....'....<(....j(....x(.....(....b).....).....).....*....p*.....*.....*.....+....T+....s+.....+.....+....9,....[,....m,.....,....Z-.....-.....-....+.......................1/...../...../...../....F0.....0.....0.....0....T1.....1.....1.....2.....2.....3....g3.....3.....3....X4.....4.....4.....4....35....P5....^5.....5....(6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\nl.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):510543
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.3904723751014965
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:9tSZJa/z0U8zKKCqqJlnTWsoTGRl5gAQK14Lo5u3:9tSZ00U8zKKCqqJlT/oTGRl5nQK0o5A
                                                                                                                                                                                                                                                                                            MD5:FD213CA62816C2359DDF60B65AEF85DB
                                                                                                                                                                                                                                                                                            SHA1:DC20EFBE976A681262C3637A9B46EABD2520EA47
                                                                                                                                                                                                                                                                                            SHA-256:F352A6614CE969DDDA4C82AFF22ACBEB7470C4DAA3074BCDC178A380F8DD6323
                                                                                                                                                                                                                                                                                            SHA-512:7ADB720C41F6E3EA615DEFB7D333BAA248456727377009AD71597EFBD79DC1005A9800E25F91EC7038FD44FC65F6FF0E59665D6E8057B8258D2481C8A1240252
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........"(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.&...s.U...t.l...v.....w.....y.....z."...|.I...}.z........................................................................................."...........D.........................................R................. .................#.....:.............................s.......................u................./.................>.....^.................Q.....`...........+.....b.....r...........W.................2.................. ....] ..... ..... ..... ..../!....|!.....!.....!....."....T"....|"....."....."....S#.....#.....#.....#....L$....{$.....$.....$....,%....V%....`%.....%.....&....7&....D&.....&.....'....4'....C'.....'.....(...._(....u(.....(.....)....[)....u).....).....*....5*....L*.....*.....+....*+....<+.....+.....,....E,....x,.....,.....-....1-....E-.....-..........;.....L............/....a/...../.....0.....0.....0.....0....n1.....1.....2....@2.....2.....3....<3....Q3.....3.....3.....4....(4.....4.....4

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\pl.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):558670
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.766613934755785
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:OrjqFS/KCrz47WzKPEWoOBCB5fQfuzSJu6HCSbqePlCUdXUe3mcRCwYLliMsuCZ2:OPqFSh1RsMD
                                                                                                                                                                                                                                                                                            MD5:62DA04B9820032F194ABF7E479A35D5D
                                                                                                                                                                                                                                                                                            SHA1:9627C98015DEA7A5DEF6EDD52B08415FA945801B
                                                                                                                                                                                                                                                                                            SHA-256:C67F03F07F57C7B374AB95B26B5F5C2A95BF3AED6CFA6E7CC85677D17B82A302
                                                                                                                                                                                                                                                                                            SHA-512:C9049D39723AE8B0CEE923A39FD87DC519F47BA149A6796BDBF60DE0C78CE37DDE9E2F6F9E3322C35D4607B085BA359CF1BD893D7513DDF79BC8AD820A3A5566
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.9...t.P...v.....w.....y.....z.....|.-...}.^.....................................................................................................4.........................................^...........(.....F.................J.....`.................A.....U........... .....T.....f...........=.....s...................................l.........................................*...........'.....r............ ..... ..... .....!....{!.....!.....!.....!....;".....".....".....".....#....M#....n#....|#.....#....E$....~$.....$.....$....M%.....%.....%.....%....G&....x&.....&.....&....3'...._'....o'.....'....+(...._(....p(.....(....Z).....).....).....*....Y*....v*.....*.....*....6+....W+....}+.....+....,,....m,.....,.....,....T-.....-.....-....'.....m................../....U/....{/...../.....0....t0.....0.....0....V1.....1.....2....02.....2....&3....i3.....3.....3....N4....{4.....4.....4.....5....;5....J5.....5.... 6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\pt-BR.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):532220
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.449879939077341
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:/qHnqHGpXCmFsIsRSfL/NBXBLax/nDMSP9/9:SHbXGIsRWi
                                                                                                                                                                                                                                                                                            MD5:46EA1E0B91D4C3FAFE8A6098C9FAA850
                                                                                                                                                                                                                                                                                            SHA1:E243BCDA9A5724658D4469A9EDF910F83DEFB0C9
                                                                                                                                                                                                                                                                                            SHA-256:5CCF5BF030DEE00C47D5574F0F9E555CAF57E6FD65D01B36143806C81451594D
                                                                                                                                                                                                                                                                                            SHA-512:C4810BCED6A0EDFC7F465AFB572DC413DDB73F0F55486681CAFD859E3DD17AEA1F63A2CEC004CE083E0BABF7ADB81099BD1541A24DEBEA9185EBDE3FFC758849
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........+(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.g...t.~...v.....w.....y.....z.4...|.[...}.....................................................................................7.....L...........d.................G...................................r.................T.......................I.....s.................0.....b.....{...........o.................k...........".....I.................a.....r...........;.....w.................y.................q ..... ....@!....a!.....!.....!....""....5"....."....."...."#....1#.....#.....#.....$....,$.....$.....$....-%....A%.....%.....%.....&....(&....v&.....&.....&.....'....P'.....'.....'.....'....;(.....(.....(.....(....f).....)..../*....H*.....*.....*.....+.....+....j+.....+.....+....7,.....,.....,.....,....a-.....-..........a.......................F/...../...../...../....J0.....0.....0.....1.....1.....2....Y2....o2.....2....p3.....3.....3....I4.....4.....4.....4....#5....o5.....5.....5.....6.....6.....6.....6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\pt-PT.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):539791
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.424066051933617
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:vyQi0AihPPswHi6osK7js5luSRg0QCY4JVJJxhIH8+4yzjFr:xRxs4TYjsLuSRuJl
                                                                                                                                                                                                                                                                                            MD5:4431474B5DD052C39BB06D802C894EF1
                                                                                                                                                                                                                                                                                            SHA1:84C4403A174E638F6EA5B434B9F83AB7F166C127
                                                                                                                                                                                                                                                                                            SHA-256:E78D6398FC395BC5FE3BABF9529919ABE1A1FE8854901284508361A123F02336
                                                                                                                                                                                                                                                                                            SHA-512:5577E98888EDC83DCBFA5FA00BCA98478C17EC72FD2C4BD1FA470F5194CE42844D3114B5629C284D37B5E3B24220618BC37F42A5CDCD1DD51BBF214C943D4D5E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........U(..e.....g.$...h.)...i.:...j.F...k.U...l.`...n.h...o.m...p.z...q.....r.....s.....t.....v.....w.3...y.Z...z.....|.....}...............................&.....-.....4.....;.....<.....=.....B.....U.....i.....~...........!.................&.................<.....P...........X.................R.................(.....w.......................V.......................p.................I...........).....w.................c.......................x.................5.......................z ..... ....T!....o!.....!....!"....P"....h".....".....#....@#....O#.....#.....$....N$....[$.....$...."%....[%....o%.....%....#&....X&....d&.....&.....'....3'....='.....'.....'.....(.....(....p(.....(.....).....).....).....)....@*....R*.....*.....+....*+....F+.....+.....+.....+.....+....a,.....,.....,.....,....t-.....-....!.....R................../....&/...../...../.....0.....0.....0.....0.....1....H1.....1....P2.....2.....2....A3.....3.....3.....4.....4.....4....?5....Z5.....5.....5.....6....-6.....6.....6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\ro.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):554060
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.480204283612533
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:4V5cXGtUUqgh6sJ5Xc+H8R3133G9Ro0x2:/GtUL8QQe
                                                                                                                                                                                                                                                                                            MD5:44666EE22FBB2D3984FCE58462CF12B6
                                                                                                                                                                                                                                                                                            SHA1:7353BD9799CDBDD1EF85B8407724F1645D59F8EC
                                                                                                                                                                                                                                                                                            SHA-256:5ECD60B010E13D79BBAF797983B9DD374ABA349DD5FCA0841E14AB4AAA887ACA
                                                                                                                                                                                                                                                                                            SHA-512:E842D0F6F3DF2274C9C89C89E89894FF9E643DDBF3C1A59DF247C4E2ED0867F10A9DD31466B687FBE327575DCF5446520DCD6874672C0B9C29E6C90FC262E5C5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........8(..e.....g.....h.....i.....j.....k.....l.$...n.,...o.1...p.>...q.D...r.P...s.....t.....v.....w.....y.....z.L...|.s...}...............................................................................*.....8.....J...........b.................;.......................q...........?.....^...........G.......................R.....|.......................W.....k...........L.................9...................................3.....L.................C.....X.................l............ ..... ..... .....!....q!.....!.....!.....!....B".....".....".....".....#....`#.....#.....#.....#....P$.....$.....$.....$....J%....y%.....%.....%....2&....\&....l&.....&.....'.....'....>'.....'.....'.....(....3(.....(....+)....~).....).....)....2*....Q*....g*.....*.....+...."+....F+.....+.....,....6,....I,.....,....:-.....-.....-..........T.....q............/....c/...../...../....-0....}0.....0.....0....R1.....1....$2....=2.....2.....3....r3.....3.....4....p4.....4.....4.....5...._5.....5.....5.....6.....6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\ru.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):881756
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.938834306773222
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:gxHO0xVfQjRo4YResEaX+jhvYDOdFMV8uaMxDkD4TL/Y0Ly30ZpXPfRQjI4c3GDy:4HO0e3GB8w
                                                                                                                                                                                                                                                                                            MD5:F8C28108E2D6CB0B719B0896D3586386
                                                                                                                                                                                                                                                                                            SHA1:FB5BFF833E36E3AC543E6B9F47C2973741BDE18F
                                                                                                                                                                                                                                                                                            SHA-256:476522A13DDDE13254D44801293AC1B757016B3C8B8A5D0769F18862CA41DE78
                                                                                                                                                                                                                                                                                            SHA-512:BEB8ACD03387EAFA4777D7C3AE0BFFA4C978D03EE1FC61FC74A63B56C57A920963C94F3CC79ED698D8BD1AFC3590B3FEB2DD9DA362311047F216F74079B5D81E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........'@.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.A...t.X...v.....w.....y.....z.....|.5...}.f...................................................................................).....P.....E.......................o...........q...........t.....1.................o...........4.....n.................%.....H.................>.....U.......................7.....*...........t ..... ....g!.....!....L"....."....(#.....#.....$.....$.....$.....%.....&....=&....A'....;(.....(.....).....).....*....J*.....*.....+....z+.....+.....+....L,.....,.....,.....-.....-..........E.....j....../...../...../.....0.....0.....1....M1....d1.....1....a2.....2.....2..../3.....3.....3.....3.....5.....5....L6....v6.....7....r7.....7.....7....A8.....8.....8.....8....i9.....9....q:.....:....~;.....<....|<.....<....i=.....=.....=.....>.....>....4?....t?.....?....r@.....@....ZA.....A....WB.....C.....C.....C.....D.....E.....F....YF.....G.....G.....G.....G....eH.....H.....I....,I.....J.....J

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\sk.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):560149
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.8136331720603405
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:gJM73C0MrAZwnEtkpTjuxd9ig43pk1Zcxvl4q:gWlMmwUld46ZcVP
                                                                                                                                                                                                                                                                                            MD5:6D9D151C9ADC59DDDA150DBAD2E9A8DF
                                                                                                                                                                                                                                                                                            SHA1:94DCBE7C2FC40A4B46B14483824DEFEE4D15487C
                                                                                                                                                                                                                                                                                            SHA-256:AC29A2DF49410F6DEAF02F9FA3F04428A260BF7E6334DF9D8A869B4165CC623B
                                                                                                                                                                                                                                                                                            SHA-512:18778010D892813EE95C62485A85563DC8BE895EF67A4C7518C5A6B4E219763CECAA3A0817CCFC54C8112FCF721AABABF48461D294D7062DE5864CA310F986DC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........8(..e.....g.....h.....i.....j.....k.....l.)...n.1...o.6...p.C...q.I...r.U...s.....t.....v.....w.....y.#...z.Q...|.x...}...............................................................................2.....D.....Y.................1.....O...........0.....b.....p.............................c.........................................*....................... .......................S...........m.................].................(.................A.....R...........Y ..... ..... ....G!.....!....%"....@".....".....".....#....+#.....#.....#.....$....$$.....$.....$.....%.....%.....%.....%....<&....R&.....&..../'....d'....u'.....'....;(....g(....t(.....(....X).....).....).....*....w*.....*.....*....V+.....+....',....?,.....,.....,.....,.....-....o-.....-.....-.....-....b................../...../.....0....H0....}0.....0....&1....B1....W1.....1....52....\2....r2.....2....d3.....3.....3....f4.....4....d5....y5.....5....g6.....6.....6....27.....7.....7.....7..../8.....8.....8.....8....B9.....9

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\sr.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):826821
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.8804212093121855
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:cGwKpSNNXuex0vMHB37Ch/k/5H76xNXISpi1VXO8aQrkL/2eeV6mP/4WF07X:cGzku50jk
                                                                                                                                                                                                                                                                                            MD5:44B3821970A5F66FEB4991C73D2AE62B
                                                                                                                                                                                                                                                                                            SHA1:F4864904453F6201A0B061552DE6E213D62FAA81
                                                                                                                                                                                                                                                                                            SHA-256:D54784C613A3883DC5574C5C66FFBC0C5B8168044B46D3F7C25FB3C06469E574
                                                                                                                                                                                                                                                                                            SHA-512:2D9CCCB2E54D6EE0C506E40B503D610BE419072396CB86AE63EF5C9BA2087DDFA43554468E4B2B1DC2D73AE46F77DFF0262C0591F30793D16490A287472A0C2F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Q(..e.....g.....h.!...i.2...j.>...k.M...l.X...n.`...o.e...p.r...q.x...r.....s.....t.....v.....w.+...y.R...z.....|.....}.....................................%.....,.....3.....4.....5.....7.....a.........................................M.......................A.....<.............................H.......................$.....w...........#.............................] ..... ..... .....!....."....8#....~#....>$.....$....=%....f%...."&.....&.....'....@'....&(.....(....]).....).....*....t+.....,....Q,.....,....Q-.....-.....-....=................../...../.....0....B0....a0....%1.....1....&2....Q2.....2....|3.....3.....3.....4.....5....L5....g5.....6.....6.....6.....6.....7.....8....i8.....8....V9.....:.....:.....:....@;.....;.....;.....<.....<.... =....Y=.....=....@>.....>.....?....<?.....@.....@.....@....WA.....A....`B.....B.....B.....C.....D....gD.....D....sE.....E....tF.....F.....G....aH.....H.....I.....J.....J.....K....fK.... L.....L.....L.... M.....M.....N....SN....pN....AO.....O

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\sv.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):500252
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.564806727763352
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:GOnnNynh349gorlSFJy2tFIp4gfivSFbT7I202f4x1676fF6Mne0n/4i054nQdn4:x3rlSS96jf
                                                                                                                                                                                                                                                                                            MD5:8ACC9AFDA8D857D872B146E7C1C5C160
                                                                                                                                                                                                                                                                                            SHA1:F0F63E84256DE2ECFD960714122F7FA9A5A2486D
                                                                                                                                                                                                                                                                                            SHA-256:93441C4FCBBB46FE36712C49A64FD2EF64C0EE2038FA1409475419F7808AC8B4
                                                                                                                                                                                                                                                                                            SHA-512:AD2FAAE53C4C40ADC8913AED69942A19B9508E6B0B4F300040556BEF4EDD178F61B9C807EEA91BAE53F66DCD300C2FF0E34F94DB04154743A66A6C821AA904BC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.3...t.J...v.....w.....y.....z.....|.'...}.X...........................................................................................................X.....n...........A.........................................d.......................q.......................q...................................0.....P...........>.......................\.......................w.................D................."...........M ..... ..... .....!....m!.....!.....!.....!....N"....s"....."....."....,#....R#....a#.....#....1$....h$....z$.....$....5%....c%....r%.....%....'&....R&....a&.....&.....'....B'....R'.....'.....(....G(....V(.....(....))....d)....y).....)....$*....D*....]*.....*.....*.....+....0+....|+.....+.....+.....+....t,.....,.....-....C-.....-.....-..........,................../....%/...../...../.....0..../0.....0....31.....1.....1.....2.....2.....2.....2....V3.....3.....3.....3....E4.....4.....4.....4.....5.....5

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\sw.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):518777
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.394177246006264
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:nIU+23lo/LnEaGHOKfzbLMk4PhEqxAW3m8QoKrmuC5fmYbqCCBaRd2hU7bsd4ips:IU+23lqbGfTS
                                                                                                                                                                                                                                                                                            MD5:9487E8C45C4ED32CA79F6AAC7C08BB30
                                                                                                                                                                                                                                                                                            SHA1:DFAB07FFA659FD9C248923829390FA2A51EA910F
                                                                                                                                                                                                                                                                                            SHA-256:3A1D2160F501266BD886E560A4F232158B524F28F3A904753384BC78E7F1B67D
                                                                                                                                                                                                                                                                                            SHA-512:0DD070C013FBC37594D1943A1C6DD5FC33F7C60AEAC16C5CDE9953B3D25AE74BD18D2F2627D0A58F8DC1CFD5446ED14A4B518DC7872CF9035940415645D1C983
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s./...t.F...v.{...w.....y.....z.....|.#...}.T.....}.....................................................................................................j.................O.........................................X.......................J...............................................3.......................n...........5.....R.................^.....n...........!.....T.....b...........).....c.....w.............................Y ..... ..... ..... ..../!....w!.....!.....!.....!....<"....c"....o"....."....R#.....#.....#.....$....\$.....$.....$.....%....f%.....%.....%.....&....V&.....&.....&.....&....L'.....'.....'.....(....r(.....(.....(....3).....).....).....)....8*.....*.....*.....*....P+.....+.....+.....+....l,.....,.....-....C-.....-.....-................y................../...../...../....&0....I0.....0....C1.....1.....1....)2.....2.....2.....2....z3.....3....-4....D4.....4.....5..../5....R5.....5....:6

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\ta.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1315544
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.14728567355759
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:VEZn9I4Zj3UoKasatRdRtm1vYpiMaOCKcfhxvKcZsQn:VEZ91WoXsutm1vYpiMa1n
                                                                                                                                                                                                                                                                                            MD5:7D55B1E92CE0FF0C633F9C0A25F4E09F
                                                                                                                                                                                                                                                                                            SHA1:61B2DA113CEA70C6781D3C56D960F77F4A5795F5
                                                                                                                                                                                                                                                                                            SHA-256:CFA684800CD838C882F8AEC6CEC2CEAFDE879021A3DCDF86870A756B91B4D88C
                                                                                                                                                                                                                                                                                            SHA-512:44723CACF66AAF0B4899B040BBF61FEEE66992D4F0959E39EDC1B0BC418A68165014E84F6141B9FCD63447AE1723F73AE78241CC01D757E69FA3B2B8B0E475D6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........ (..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r."...s.Q...t.h...v.....w.....y.....z.....|.E...}.v............................................................................._.......................G.....}.................<...........(....................... .....z .....!....@"....~".....#....r$.....$.....%.....%.....&....='....e'.....(.....)....,*.....*.....+....7-..........h....../.....0....?1.....1.....2.....3.....4.....4.....6....k7....D8.....8....":....V;....S<.....<.....=....o>.....>.....?.....?.....@....AA....rA....ZB....)C.....C.....C.....D.....E.....F.....F.....G.....H....8I....rI....`J....KK.....K.....K.....L.....M....MN.....N....{O....lP.....P.....Q....tR.....S.....T.....T.....U.....V....;W....yW....\X....)Y.....Y.....Y.....Z.....[....Z\.....\.....].....^....a_....._.....`.....a.....a.....b....Tc....Xd.....d....;e.....f.....g.....h.....h.....j.....l....En....}n.....o.....p.....q.....r....{s.....t....Qu.....u.....v.....w.....x....cx.....y.....z

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\te.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1204346
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.399328838105026
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:zp/JXDMeIBW7McKNQuA/2TZB8TjJAM8fHquDYH/grshTWFsmcTvqdW/3wkAE26Kh:HXDM1Hnhp
                                                                                                                                                                                                                                                                                            MD5:5FA6A53CA49BEE9688F6179012418EAB
                                                                                                                                                                                                                                                                                            SHA1:E413EC4486B428313B6D5563E782F5EB99C9CDD5
                                                                                                                                                                                                                                                                                            SHA-256:5DD29DC56EF3D0BB166A4BEC41AB186FE5E95987871BBAFB12E369C5AA127B45
                                                                                                                                                                                                                                                                                            SHA-512:77A416878B53B0B933ACE71ED137A157159D39073C3A8A5F73BB104B2C5C3036302E3B20D609558380F519EF4BFF58243739A052D487380A28BFBA429BB3F3EF
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(F.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.>...t.U...v.....w.....y.....z.....|.2...}.c.............................................................................R.................\...........z...................................y...........`..................!.....!.....!....."....x#.....#.....#.....%.....%....S&.....&.....'....{(.....(....;).....*.....+.....,....(-....^.....R/...../....)0....e1....\2.....2..../3.....4.....5.....6.....7....z8.....9.....:....!;.....<.....<.....=....F=....o>....4?.....?.....?.....@.....A....$B....eB.....C.....D....0E.....E.....F.....G.....H....YH....yI....JJ.....J.....K....!L.....L....gM.....M.....N.....O.....P....`P.....Q.....R....LS.....S.....T....AU.....U.....U.....V....CW....~W.....W....uX....*Y.....Y....#Z.....[.....\.....].....].....^....\_....._.....`....Da...."b.....b.....b....>d.....d.....e.....e.....g....:i....kj.....j.....l....?m.....m....jn.....o.....p....9q.....q.....r....Xs.....s.....t....Zu....Uv

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\th.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1035262
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.465979299112675
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:Def//cfE9v4rN9LyZYA7C4FkcS5kI4kZ1mT56pLTVNwqXH6NJ0HJuHIzXw1pCDCI:DekE9v9Ng
                                                                                                                                                                                                                                                                                            MD5:457A8C9E7D6B36A30DAE22ECF2E01E04
                                                                                                                                                                                                                                                                                            SHA1:7D720B5C520C366EC9C8AF40BD767E640A8346D4
                                                                                                                                                                                                                                                                                            SHA-256:07E203B3FA76EB201DD5B0C66C53AA4DCD2F61C77F4E3970F4C931D558BF6BB8
                                                                                                                                                                                                                                                                                            SHA-512:F5C4684E43E5EE85C9900F6AF4C4D6AB015896AC3DF7F2D68CA1407B0CBE3289C1214FC6D3FC5189743D32E97841A2FB5CE77DFCB853F63685F0D957BFDCC330
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........g'q.e.@...g.H...h.M...i.U...j.`...k.o...l.u...o.}...p.....q.....r.....s.....t.....v.....w.C...y.j...z.....|.....}...................&.....1.....9.....>.....F.....M.....T.....[.....].....b.......................U.....f.....=.......................y.....................................................v...........i...........6.....W...........s........................ ....4!.....!....."....7#.....#.....#.....$....k%.....%.....&.....&.....'.....'.....(.....(.....).....)....'*...._+....N,.....-....L-....+............/....Q/.....0.....0....81....Y1.....2.....2.....3....(3.....4.....4....05....Z5....,6.....6....M7....q7....=8.....8....^9.....9....8:.....:....-;....H;.....<.....<....>=....e=.....>....|?....@@....h@...."A.....A.....A....'B.....B....cC.....C.....C.....D.....D....hE.....E.....F....mG.....G....sH.....I.....I.....I.....I.....J....UK.....K.....K.....L....dM.....M....)N....,O.....P.....P.....P....+R.....S.....S....=T....0U.....U....aV.....V....GW.....W....:X....YX....bY....+Z

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\tr.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):532963
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.6388661918144765
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:UQQAbu3qaVSJO1ZAYoaJzAci1U6edPO7TNaI6QVSjYtz6qh5nT/rTx3jF/7hDfQq:TJbuaaSJHPaJL69Dt
                                                                                                                                                                                                                                                                                            MD5:825927D25145C30AC5D0E706387DA444
                                                                                                                                                                                                                                                                                            SHA1:20B55D77CB0B67BA63C26B369EB86AF9456BC14E
                                                                                                                                                                                                                                                                                            SHA-256:110E4B113D5FE1C2537BA68D4AC77135C93E984BA3A7861B9AAC8DCA740A5BFC
                                                                                                                                                                                                                                                                                            SHA-512:C371E449666F82AE53B50529F7A075D2B865981CE57266BAEEEBC91378BD214F4EB0B089ADD01DE5942237FAA26B7464B561619E48589895583268C796199A3D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........E(..e.....g.....h.....i.....j.$...k.3...l.>...n.F...o.K...p.X...q.^...r.j...s.....t.....v.....w.....y.8...z.f...|.....}.........................................................................5.....Q.....f...................................o.................#.................d.................@.....{.................7.....^.....m...........#.....P.....b...........2.....d.................y.................>.......................=.......................J.............................. ....M ....e ..... ....%!....O!....k!.....!....*"....Y"....j"....."....&#....T#....d#.....#..../$....f$....s$.....$....B%....y%.....%.....%....K&....}&.....&.....&....F'....v'.....'.....'....G(....{(.....(.....).....).....).....)...._*.....*.....*.....+....`+.....+.....+.....+....@,.....,.....,.....,....S-.....-.....-..........q.......................X/...../...../...../....p0.....0.....1....#1.....1....n2.....2.....2.....3.....3....B4....f4.....4....l5.....5.....5....56.....6.....6.....6....L7.....7

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\uk.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):878910
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.972018764763047
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:b9STXyPCdB3IjZbArIorn3HuGZ7q+4uL2un9oVEmNisSr+hLwrh1/3C4/gXkYdN:WXycrc
                                                                                                                                                                                                                                                                                            MD5:E9FE3BF9348EAD93394869C910FAFD56
                                                                                                                                                                                                                                                                                            SHA1:F3B6F4FDEAB50D22C22146770E3FA147F0111BCD
                                                                                                                                                                                                                                                                                            SHA-256:5702466E7FCBDEC7FE8C21CFF53F3AADC34870E466F6D3C1BCC4D2AF7A43FEB1
                                                                                                                                                                                                                                                                                            SHA-512:A12FBA648BFA3737D97DBBE44FA22934C69A0E1468BD56534ABF19A9BA96238715A3C9DE9F21AD09A6B37FA087CFEDCB108B3C2B5B818885081528BDDD4EC637
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........(..e.r...g.z...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.(...v.]...w.....y.....z.....|.....}.6....._.....d.....l.....t.....|...........................................................H.....3.......................m...........s...........h.............................7.............................i...........'.................(...........w............ ..... .....!....8"....t"....&#.....#.... $....F$.....$.....%.....%.....&.....&....r'.....'.....(.....(.....)....I*.....*.....+....|+.....+.....+....m,.....,....)-....J-.....-....I.................Y/...../....W0....~0.....1.....1.....1.....2.....2.....3....c3....|3.....4.....4.....4.....4.....5.....6....M6....h6....a7....18.....8.....8.....9.....:....R:....t:.....:....J;....s;.....;....F<.....<....e=.....=....u>....)?.....?.....@.....@.....A....MA....zA....!B.....B.....B.....C.....C....nD.....D.....E.....F.....F....yG.....G.....H....LI.....I.....J.....J....UK.....K.....K....VL.....L.....M..../M.....N.....N

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\vi.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):625905
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.8267395735794665
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:axz7Go+cJ8AKGKyuJOXdziRHHskgLuKp1q/afFJq6r2D2g6MFi9CsTmFg/:alp+cJ83GvqOXhiRskgL11qyfjq6rIIP
                                                                                                                                                                                                                                                                                            MD5:C7D9AF900BAC3FB4497BB279EE3FA570
                                                                                                                                                                                                                                                                                            SHA1:90565512D2374D885D5CB684F136094D5C6701A1
                                                                                                                                                                                                                                                                                            SHA-256:8FFEE6239F923A813EEC9A5D7A2925F8550248085277BD8A1A649961B3CCDA90
                                                                                                                                                                                                                                                                                            SHA-512:8EF1F167D276FF1B65C1E761929E53120E5E60DB3F44E588F3F12AA34298A018F887219B6C7D79003C6B7CAEAA0A4EDB5D2B6C00CE7A39A08327599788130D9D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........'..e.@...g.H...h.M...i.g...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.4...w.`...y.....z.....|.....}.......6.....;.....C.....K.....S.....Z.....a.....h.....i.....j.....l.....}.............................9.................\...........1.....H.........................................g.................).....O.....[...........1.....i.....|...................................{.......................).................. ..... ..... ..... .....!....%"....."....."....^#.....#....[$.....$.....$....Y%.....%.....%.....&.....&.....&.....&....,'.....'.....'.....'....k(.....(..../)....F).....).....*....S*....d*.....*.....+....b+....q+.....+....;,....m,....{,.....,....`-.....-.....-....\...........b/...../...../....n0.....0.....0....@1.....1.....1....I2.....2.....2.....3.....3....R4.....4.....5.....5.....5...."6....D6.....6....A7....|7.....7....88.....8.....8.....9.....9....]:.....:.....:.....;....C<.....<.....<...._=.....=.....=.....>.....>.....>.....?....0?.....?....b@.....@

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\zh-CN.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):449223
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.746582834553807
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:iAHCehx5MFK9FAUxmPQ44PcF+fqWlGXop+S47C+M3JZ1:p9yCIQ44P4J4IS/+M3z1
                                                                                                                                                                                                                                                                                            MD5:AA4309E5581E6D9EBECF462EA16E51A5
                                                                                                                                                                                                                                                                                            SHA1:3A7915120C1FF6485DF10F0AD18B96191A101A1E
                                                                                                                                                                                                                                                                                            SHA-256:1E68A1B1CC4FC15BF4EB381389D9F365768B56F4B50F994AF6C3C7A21A8B5F43
                                                                                                                                                                                                                                                                                            SHA-512:101F875B312868B2165B21843AE208E25157E502A2B41A5C84CC81CF449BAD41DE47CC0CF4631151B5D9704338F0E13519A5486D482512E152C5D9E8DA95DDAF
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........m'k.e.L...g.T...h.Y...i.a...j.d...k.....l.....m.....o.....p.....q.....r.....s.....t.%...v.Z...w.....|.....}.........................".....1.....6.....>.....E.....L.....N.....S.....\.....n.........................................j.......................h.......................s.................).....w.......................O.............................}.........................................J.......................;.......................!.....y.................(.......................+.....n.......................5.....[.....g.......................).................1 ....C ..... ..... .....!.....!....v!.....!.....!....."....["....."....."....."....3#.....#.....#.....#....6$.....$.....$.....$....G%.....%.....%.....%.....&....l&.....&.....&.....'...._'.....'.....'.....'....B(....v(.....(.....(....%)....?)....K).....).....*....-*....?*.....*.....+....6+....V+.....+....?,.....,.....,.....-....e-.....-.....-..........b.......................*/....H/....X/...../.....0....80....J0

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\localization\zh-TW.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):453189
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.748972145786427
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:dKxmos2b1wjA+kcCnv96HtXZ6kIT8blUppfy/j4s2THkBgjTY:dKxmo7xwjPCnUB89pyssCkBgjTY
                                                                                                                                                                                                                                                                                            MD5:D853727358D50EF2947AC8CA9475F369
                                                                                                                                                                                                                                                                                            SHA1:8569B990CD59640FB254E9CACBD157C4143F12A1
                                                                                                                                                                                                                                                                                            SHA-256:1196321347BD13295A6BE4EF2CE8C1C7200214E376E53D7DD4E1032A2ADA97A6
                                                                                                                                                                                                                                                                                            SHA-512:E377B5C80DED4B8671025CBFAF5872BBBB34C9112069CBCDE6D62904320AE90F204FDF3CAF1DDC4745BD4BDD2C9400323E2BC13B72A85CB344E01831DC135C21
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........|'\.e.j...g.r...h.w...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.H...w.t...y.....z.....|.....}.!.....J.....O.....W....._.....f.....m.....t.....v.....{.............................(.......................D.......................0.......................,.............................i.......................:.....[.....h.................>.....X.................D.....Y.................:.....G.......................$.......................1.................G.....Y.............................W.............................n.......................H.....q.....}...........% ....N ....Z ..... .....!....=!....I!.....!.....!.....".... "....s"....."....."....."....d#.....#.....#.....$....Z$.....$.....$.....$.... %....f%.....%.....%....:&....d&....v&.....&....#'....T'....w'.....'.....'.....(.....(....x(.....(.....(.....(....c).....).....).....)....l*.....*....-+....<+.....+.....,....C,....X,.....,.....-....7-....C-.....-.....-.....-.....-....=.......................-/

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\mojo_core.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1968536
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.482423266304284
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:b0139pO0hsRv1sBSF0oTu160MdjMCZMVIMgfHFu+kgWnI88QBgJ9Q4:b0J3xEvF0oTucjM2MK9fHFbkg48QBgHT
                                                                                                                                                                                                                                                                                            MD5:6270C23C10F316C1280DE44C85BCADAF
                                                                                                                                                                                                                                                                                            SHA1:2386A258089D6CEB3EA45EEA66F731D69892735E
                                                                                                                                                                                                                                                                                            SHA-256:8DCA763B5FEDFC6E37DC9E8CA50D3A6BDF8FA33E50CE0811B2E300D31157BCEF
                                                                                                                                                                                                                                                                                            SHA-512:3695DEC4A2F03D887A699C94442842C2F0A3285124A18F70372AFCECDF56842528834CA8C4EDB9E3269CE29A71BF39BDCC79DE3DF4E225524468D225BD887B75
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....H...........6.......................................0......E.....`A............................................p.......................8........)......h!..|...8...................`...(....q..@............................................text....F.......H.................. ..`.rdata...d...`...f...L..............@..@.data...p...........................@....pdata..8...........................@..@.gxfg....).......*..................@..@.retplne.................................tls................................@..._RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..h!......."..................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\notification_helper.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1323928
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.483666694877683
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:msHjCiUls9fjV5v3ZxhIdfiFCQR+bCaTKT856Vg/VVmQGQrVpmMEATobJYJK/Ejw:zjCiUK9jzidfkCE+72TOT1xXJrJX05
                                                                                                                                                                                                                                                                                            MD5:624744B32D32441617A362C52B5BF5A7
                                                                                                                                                                                                                                                                                            SHA1:93330F50AD3D99413A298DCD012AE05A5B49113A
                                                                                                                                                                                                                                                                                            SHA-256:5701710FFBE7CD6927F7DC656C2EE65B20636FBAB08FD9A88B3E88A0CB9B1EEB
                                                                                                                                                                                                                                                                                            SHA-512:93253434D6CF2C7D6A46654E13E65F12B21002396496C82FB4531A9834A7293DBF8B4D06311F0399F4461F098103FB83DF3CD5A51AD4C7CC3F0C14A3DD468A77
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......*.....................@....................................vs....`............................................\...D........P.. ....P...........)...`..h...............................(....A..@...........P...@............................text....(.......*.................. ..`.rdata.......@......................@..@.data........`.......@..............@....pdata.......P......................@..@.gxfg....+.......,..................@..@.retplne.................................tls....y.... ......................@...CPADinfo@....0......................@..._RDATA.......@......................@..@.rsrc... ....P......................@..@.reloc..h....`......................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1493400
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.361678504526369
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:Sl3NAeA1+ibmbsjLNVcP6f2B2MJkgbg6DwMU98C8x:cmRUbsDg6q2QZbgWUOCK
                                                                                                                                                                                                                                                                                            MD5:94851594215654A9EFCE5F3C3830A9C1
                                                                                                                                                                                                                                                                                            SHA1:C8E487ADBEDE70014AB12FE8CF546723C4AF46AD
                                                                                                                                                                                                                                                                                            SHA-256:3296D7B4C88F1BFC356A509622376B6BE8B103EF0C9A8D1D6BAF4A2E2C27606F
                                                                                                                                                                                                                                                                                            SHA-512:13CEDB13EF86653FBFEA33D16A732F20134AF8364D0BD3468F46ECD46D7424059FEC7968D4CB112ED248F5594F964ABE8CB3E643317E79C653BAC124D670A66D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..................k.........@..........................................`.........................................h...k.......P.......@.......T{.......)..............8...................p...(.......@.......................@....................text...m........................... ..`.rdata..T...........................@..@.data...<....p.......^..............@....pdata..T{.......|...H..............@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera.exe.sig

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1471
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.6066716502178275
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:+iCNV9ue/BbGNo7H6lah8keReriJ8gLIcO5v4Duvw5HjgTa/SQEbxPch11:+iCHMepSN078kfipLIckwFj8a/Qo1
                                                                                                                                                                                                                                                                                            MD5:DEB528BAAC9309AB0C3BFD65B1022DC5
                                                                                                                                                                                                                                                                                            SHA1:70110D7B3D24B34B97E4C398854F4A3A19A688F9
                                                                                                                                                                                                                                                                                            SHA-256:82FFA2ACD9B53652C78CE467623FF69FA7D41938DC142C20DB50B7717B5EFD9C
                                                                                                                                                                                                                                                                                            SHA-512:8AFCD5A293A2475481C70525A26280ECB5D321CE733C8B69AE36210911543619C24AE89F7AC8889029524789413B7211CE591822B658D6D2F26F87CAF5031C2B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:....0...0................K)..3...[.40...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...180627202339Z..280624202339Z0..1.0...U....PL1.0...U....DOLNOSLASKIE1.0...U....WROCLAW1.0...U....Opera Software AS1.0...U....DESKTOP1.0...U....DESKTOP PROD1'0%..*.H........wdzierzanowski@opera.com0.."0...*.H.............0.........x.....jn...)>a.....-} .v...P..S..x.>k{.........Tr..Yo.D....d.....l.v.wU. .A.W5..oor....-Vs.o.......yH.pJ...?.Whs0`....Jb....3/. tl..8c........C..Byq>h..3A8..{..p....\..n...Q.t....0mQ{j......U|.W\...........s!....K...'.....s..s....P..r8..........0..0...U.......`..\../X.l...e....w0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0...*.H..............D.G....gtpx.......~...v.....c..%.I.....c2Y.Y.....Y^..Aa..A.b.Y.f..Zra*.),K.....n.1r.C...Z...)....W.r.gu.Z....l......S.CF.m.Y...P.W..y.f.\,.$.>...!...FK....j....XHn.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):55529567
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.944121200286667
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:1572864:ZH63+m2ypAGAjSYL5bMjLZBuRl+mH0qv3P9:ZOYlyYL52LZBY+g0qv3P9
                                                                                                                                                                                                                                                                                            MD5:BABAF9936E6038F52AF37ACA44202BBE
                                                                                                                                                                                                                                                                                            SHA1:A5EC98038CDDD2EEBD2AFD43588615A9AC26B685
                                                                                                                                                                                                                                                                                            SHA-256:62964B23E130065F9F2386DCC8F9D6F576EA801F1D531BDE171ADA9B292A5197
                                                                                                                                                                                                                                                                                            SHA-512:8FB12F7E383ED094F1D265FE5964291654CF4ED503D6524AD61776F1050989D29DCE4AA7C0DE5E61A1701D57BAC300D4880FFE19C85A1DE68B768EAA17136E9D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:..........+.f..T..{..^..|..a....ne.....g......................n...........X.......................@...........w....E.....E.....E.....F.(...F.,...F`/...F.4...F.7...FM9...F_:...FB=...GC@...GWB...G3I...G.K...G.S...GBV...GQY...G.k...G{m...G]r...G.s...GNz...G.}...G.....G.....H.....H.....Hi....H.....H.....H~....Im....IO....I9....ID....I/....I.....I2....I/....I[....I....4I....5I.....J{....JC....J....ZKw...[K....\K....^L...._L;...`L...aLb...bLH...cL....dL....eLT...fL....gL.D..hL.Y..DM....EM.....O.....O7...@Q...AQ....BQ0...CQ...DQ....EQ....FQ....GQ....HQ....T.'...T8)...T.*...T.-...T.0...T.2...T.6...T<<...TC>...T.C...T.G...T.I...T.J...T.L...T;N...T.P...T.U...TzX...T.Y...T.\...TC`...T.a...V^c...V.e...VBm...VVy...V.{...V....XW]...YW...ZW...bW....cW&...dWr...eW....fW}...vW....wW....xW....W....Wo....W.....W.....W.....W.....W.....W.....W.....W.....W.....X.....X%....X.....X.....X. ...X.*...X.0...XA4...XTD...XKF...XeK...X.N...YNS...Y6U...Y.X...Y]c...Y0d...Y.f...YLj...Y.k...Y.r...Y.t...Y,{...Y.}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera.visualelementsmanifest.xml

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):317
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.996593526126476
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6:ejHyaVic4subiL/bWHMjizddDhkQwYZXXKmJfFmkQwYEbghuPYEpwhugVFQ:eF8iDbWHMjizd2O/fbrghuP5whuQFQ
                                                                                                                                                                                                                                                                                            MD5:E8D8EAA4C2826C083AB9243B5CBD7BF8
                                                                                                                                                                                                                                                                                            SHA1:534361AE03417DFD14EBD6F961B707C75A2AF41A
                                                                                                                                                                                                                                                                                            SHA-256:B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
                                                                                                                                                                                                                                                                                            SHA-512:8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_100_percent.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1533592
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.970457890451963
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:6+QAX6oO0TOpc0vrDUwB9McYJZz3V13u811iv75iopWrLuSaM5DK2Sdi5QUCAXlz:SS6BKOp3vnUwgcYb3J1187ErLum5DZqe
                                                                                                                                                                                                                                                                                            MD5:501EBF84224562852384A0F1C386962A
                                                                                                                                                                                                                                                                                            SHA1:469B88AB9B573B7510594CA46CF476849E6EC0E9
                                                                                                                                                                                                                                                                                            SHA-256:F18526976AF998D73503ADBC1C0E6499C39B67CC089F63928690F0BB55265884
                                                                                                                                                                                                                                                                                            SHA-512:97DD142C761E55A1A0494513B3EDC50A13C2D29F18C1406D7678ABAF41794B54CDD616BECEA8E2EBAEF41812090A376D0A1921B2B0D04A3777688E8A3EE32574
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:..........5.........C...2x....3x....4x....5xm ..6x.!..8x."..9x.%..:x^(..;xX*..<x.-..=xc0..>x.2..?xA6..@xd8..Ax.C..Bx.M..Cx.P..Dx.T..Ex.X..Fx.Z..Gx.[..Hx._..Ix.a..Jx6c..Kx.g..Lx0k..Mx+n..Vxrq..Wx.s..YxWt..[x~u..lz0w..mz....nz....oz....pz.....|....|.....|.....|.....|.....|... |...!|....`|I...a|...b|X...c|....d|....e|1...j|...k|....l|g.....,........... ...........;...................................x.....X.....:.......................5.............................Q...........~.......................Y .... ....!...]"...'#....#....$...%%....%....&...X'....'...[(....(....)...{)....)...;*....*....,....5....7....;...L@...\K....M....AU....\...{a....f...m...wo....t....w...o................k................q.....<..........................................................l...........p.......................K.....y...........l...........l.....A...............2.....3.....4.....5.....6.....8.....;.v...<.....=.-...>.....?.u...E.c...F.?...G.....H.....I...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_125_percent.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1617155
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.968697130914655
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:3Pjr+13vnUwgcYsPqla83gPFNcmucLum5DZcGUbXl2Y6:/+3vUw9Yk9eKH6ch5Dsb+
                                                                                                                                                                                                                                                                                            MD5:C4EF628B6E771E18F86FB12E8F5CC9E1
                                                                                                                                                                                                                                                                                            SHA1:9BB33F09F53BD88FA10727484FBEA933F39DA697
                                                                                                                                                                                                                                                                                            SHA-256:724E01BEE1434ADA6025057403D4C723C1D7AFC3DBC8FA652CCE720E2CAF7C25
                                                                                                                                                                                                                                                                                            SHA-512:D2C3885FC9B8D73D22CB0508B59D314F8DB22B1BB29BF39BAF792BF9EAD6FEAD54527A182202DB21FA13DFF8D0C1C5CF1799F2C16AAFBFD95B18A063C96DE105
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........s.-...x................. .................^.....s........................ ....!!....R"....|#....a$....H%....2&.....&....Q'.....'....[(.....(....J).....).....*....d+....e,....!-....<..........0....0....1....2....3...`4...I5....6....6....7...!8....8....8...e9....9...=:....:...G;....;...M<...\>....G....I....L...'R...C]....^....@g...#n...s....y............L....5.............]....N..........>...........$.................y.................................................................I...........A...................................'.....................2.....3.....4.....5.....6.....8.....;.....<.s...=.....>.j...?.8...E.2#..F..$..G..$..H..%..I..&..J.\'..K..(..L._)..M.a*...b+....+....,....,...*-...`....9/....0....0...:1....1....1...N2....2....2....9.....=...=...$>...>...I?....?...z@....A...A....B...~B....B...VC....C...D.....D...ZE....E...$F...F.....G....oG.....G....eH.....H....6I.....I.....J....wJ.....J

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_150_percent.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1775067
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.968447920099208
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:1jr+m3vnUwgcYiLqRnY0GbcY8PPLum5DZJ4UbXl2Y6:1d3vUw9YiLqRKsPh5D3b+
                                                                                                                                                                                                                                                                                            MD5:60D9A1E25C1BEC3FED1C50A9979C9C51
                                                                                                                                                                                                                                                                                            SHA1:7A8EA5AD8519FBBB71C54C12139A5CD2B52CB525
                                                                                                                                                                                                                                                                                            SHA-256:292CD4BB0AC044EB78973B99EF7CD0783ACD12EB160D49B02F2CC519193BDFA2
                                                                                                                                                                                                                                                                                            SHA-512:FCE40A0D3FF0CBECC1A0302425466C704F6694C131CDB5F10C55DB8C78E90BB813FD9069F3107979F62E46237AE30D3AD3DD90B6CAB9C339C680C5FF2BE05B00
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........s.-...x.................#.................`.................V............ ....."....\#.....$.....%.....&.....'.....(.....).....).....*.....*.....+....y+.....,.....-.........../.....0....1...#3....3...]5...46....7...h8....9....:....;....<...4=....=....>...x>....>...P?....?...Z@....@...`A...oC....L....N....R...:W...Vb....d....Sl...6s...x....~............_....H.............p....a..........Q...........7...................................'.................+.................&...........\...........T......................."...........:.....................2.....3.....4.....5.)...6.j...8.....;.....<.....=.r...>.....?..#..E..(..F..)..G.u*..H.K+..I.!,..J..,..K..-..L.....M../....0...T1....1....2....2....3....4....5....6....6....7...`7....7....8...g8....>....}B....C...C...#D...D...QE....E...F....G...wG....G...iH....H...bI....J....ZJ....J...<K...K....L.....L.....L....\M.....M..../N.....N.....O....{O.....O....OP

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_200_percent.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2201518
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.968488233187548
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:vvAqRjrOK+3vnUwgcY/8ZOA6AwxI5ieRJYdPLum5DZ4+EUbXl2Y6:HAqRuK+3vUw9YkZOcwG5ieRJSh5DVb+
                                                                                                                                                                                                                                                                                            MD5:0D7F579FCA4052A25063028B29D7CA1E
                                                                                                                                                                                                                                                                                            SHA1:82D320B084C8CE8B0A2D7D75DEF5318334C0C774
                                                                                                                                                                                                                                                                                            SHA-256:BBD8F4ABD5D28AF9C2C063A41130F66D029F442BE23F7396E2B266D05EFE4CEC
                                                                                                                                                                                                                                                                                            SHA-512:DB573F727F74FCCF19A4A6BC66746E689BADF581F2F99A1138D8BD4ABAC3D855ECA5268AAC1D713835741C119717B120BC12E8619554DAE281E2260F8D83B16B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:..........5.........J...2x....3x....4x.%..5x.+..6x....8x./..9x.6..:x.;..;x.>..<x\F..=x.K..>x.P..?xgX..@x7\..Ax.p..Bx....Cx....Dx....ExX...Fx...Gx....Hx...Ix!...Jx...Kx...Lx....Mx....Vx....Wx....Yx....[x....lz`...mz....nz.$..oza%..pzL&...|.)...|.-...|.1...|.3...|.7...|?:.. |\>..!|2B..`|.E..a|qG..b|.H..c|7J..d|*K..e|.K..j|oL..k|P...l|...........M............................F................B................k................e..........V..........6.................~...........Z...........S.....d.........H................................................................b.........:.........L........................3..........0...........................<....%#...,..../...M8...><....E.....P....uT.....V.....^....ug....Hi....hl....up.....w.....x.......................................s.......................................}..........................2.....3.....4.....5.:...6.....8.....;.....<.....=.....>.....?.j...E.K...F.....G.....H.....I...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_250_percent.pak

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1876800
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.964539285843299
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:rjr+nMAURBgoY/jL/nU2SZ17nnVZJkLum5DZpVBIUbXl2Y6:rmlYBc/jLUnnnXKh5Dp5b+
                                                                                                                                                                                                                                                                                            MD5:B3C49B3734B0FFA4587F44AA53C9C6DC
                                                                                                                                                                                                                                                                                            SHA1:FF24B905F93BDE724DCE2AB4E63A88B6EC3C5D25
                                                                                                                                                                                                                                                                                            SHA-256:07DAEC7C2865E276F7B4A2BF790FA943612BD69B944802FBAD6113796DECE892
                                                                                                                                                                                                                                                                                            SHA-512:EBD8C7297E9C06838762B027F4420F1D22E5F9D79592CAEA3A223BDCEA24F25B9DAF85BA0CFD56DB732E4AFFA145D878A5254718532532B499E3F6DE75FCAACA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........C.0...d...........r.................\.......................+......!....h#....[%....M'.....).....+.....-...../....V0.....0....:1.....1.....2.....2.....2.....3.....4.....5.....6.....8....9...3<...f=...m?....@....B....D...!E....F...@G....H...tH....H...LI....I...$J....J....K....M...WV...`X....[....`....k....m.....u....|...K............k..........................................>.................>.....2.........................................y.....\...........x...................................[...........F.................l.....}...2.....3.Z...4.H...5.....6.. ..8.s"..;.N#..<..$..=..'..>..)..?.}...E.w3..F._4..G. 5..H..5..I..6..J..7..K.a8..L..9..M..:....;....;...b<....<...o=....>...~?...U@....@....A....A...ZB....B....C...aC....I....wM....N...N....O...O...KP....P...|Q....R...qR....R...cS....S...\T....T....TU....U...6V...V....W.....W.....W....VX.....X....)Y.....Y.....Z....uZ.....Z....I[.....[.....[....P\

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5819288
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.516225214128497
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:ICS80y0IR9jrCUWNuxJ7ORElJw5H8WOWBCH0ckcW7qqm1YgvJbMUnFSy79m3e5RT:t00Rtiu6fJUpkcWPiZrFSy7PezefVPKM
                                                                                                                                                                                                                                                                                            MD5:84762F0101AE1F06BCB76F70A0308FD0
                                                                                                                                                                                                                                                                                            SHA1:401EA43542EDE3D1A877A9C0ECC4E95914ADF995
                                                                                                                                                                                                                                                                                            SHA-256:7C2DCD7606449D72BD4E54C2C6932E286F2ADA42C996E8F2B5043EFC915DD046
                                                                                                                                                                                                                                                                                            SHA-512:72E11FD1DAC04EFB622DFA7131CD7F8354B474A5FC49B8A60481E4EF850D10BAC554F811A667148B9081D58F95BA18D8D9D6F061274479E7D4BB2638E977FF74
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......2H..V........,........@..............................Z.......Y...`..........................................iR.Y....iR.......X..`....V.T7....X..)...`Z..B...'R.8....................%R.(... cH.@............{R......iR.@....................text....1H......2H................. ..`.rdata...+...PH..,...6H.............@..@.data....y....S......bS.............@....pdata..T7....V..8...pT.............@..@.gxfg...04...@X..6....V.............@..@.retplne......X.......V..................tls....a.....X.......V.............@...CPADinfo@.....X.......V.............@...LZMADEC.......X.......V............. ..`_RDATA........X.......V.............@..@malloc_h......X.......V............. ..`.rsrc....`....X..b....V.............@..@.reloc...B...`Z..D...^X.............@..B................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.exe.1730212712.old (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5819288
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.516225214128497
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:ICS80y0IR9jrCUWNuxJ7ORElJw5H8WOWBCH0ckcW7qqm1YgvJbMUnFSy79m3e5RT:t00Rtiu6fJUpkcWPiZrFSy7PezefVPKM
                                                                                                                                                                                                                                                                                            MD5:84762F0101AE1F06BCB76F70A0308FD0
                                                                                                                                                                                                                                                                                            SHA1:401EA43542EDE3D1A877A9C0ECC4E95914ADF995
                                                                                                                                                                                                                                                                                            SHA-256:7C2DCD7606449D72BD4E54C2C6932E286F2ADA42C996E8F2B5043EFC915DD046
                                                                                                                                                                                                                                                                                            SHA-512:72E11FD1DAC04EFB622DFA7131CD7F8354B474A5FC49B8A60481E4EF850D10BAC554F811A667148B9081D58F95BA18D8D9D6F061274479E7D4BB2638E977FF74
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......2H..V........,........@..............................Z.......Y...`..........................................iR.Y....iR.......X..`....V.T7....X..)...`Z..B...'R.8....................%R.(... cH.@............{R......iR.@....................text....1H......2H................. ..`.rdata...+...PH..,...6H.............@..@.data....y....S......bS.............@....pdata..T7....V..8...pT.............@..@.gxfg...04...@X..6....V.............@..@.retplne......X.......V..................tls....a.....X.......V.............@...CPADinfo@.....X.......V.............@...LZMADEC.......X.......V............. ..`_RDATA........X.......V.............@..@malloc_h......X.......V............. ..`.rsrc....`....X..b....V.............@..@.reloc...B...`Z..D...^X.............@..B................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.licenses

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):14004
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.037159328058129
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:384:SrNYrOXburxrs4rsFm1DLTryOibEYI3WSOZzxrsCrsRm1DLY7/ymu:KYXtBLDLTryLQ4ZllRDLs/ymu
                                                                                                                                                                                                                                                                                            MD5:2528B26988213FE5C0EE9CE75ACC2935
                                                                                                                                                                                                                                                                                            SHA1:D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
                                                                                                                                                                                                                                                                                            SHA-256:42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
                                                                                                                                                                                                                                                                                            SHA-512:F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.licenses.1730212712.old (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):14004
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.037159328058129
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:384:SrNYrOXburxrs4rsFm1DLTryOibEYI3WSOZzxrsCrsRm1DLY7/ymu:KYXtBLDLTryLQ4ZllRDLs/ymu
                                                                                                                                                                                                                                                                                            MD5:2528B26988213FE5C0EE9CE75ACC2935
                                                                                                                                                                                                                                                                                            SHA1:D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
                                                                                                                                                                                                                                                                                            SHA-256:42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
                                                                                                                                                                                                                                                                                            SHA-512:F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.version

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.2516291673878226
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3:SWhv:SW5
                                                                                                                                                                                                                                                                                            MD5:0589F66713BC44029A1A720B9A0D850D
                                                                                                                                                                                                                                                                                            SHA1:2FDF7D04F0372055C9D77CA43D9A3C08798905F3
                                                                                                                                                                                                                                                                                            SHA-256:64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
                                                                                                                                                                                                                                                                                            SHA-512:31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:1.3.0.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_autoupdate.version.1730212712.old (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.2516291673878226
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3:SWhv:SW5
                                                                                                                                                                                                                                                                                            MD5:0589F66713BC44029A1A720B9A0D850D
                                                                                                                                                                                                                                                                                            SHA1:2FDF7D04F0372055C9D77CA43D9A3C08798905F3
                                                                                                                                                                                                                                                                                            SHA-256:64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
                                                                                                                                                                                                                                                                                            SHA-512:31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:1.3.0.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_browser.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):227315608
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.699495531861353
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:1572864:HnsJHWnzkYqZ6YGW5VUiBtWBeQctQ0wEe05ZoGJfpcRTU/toLfWwFCebOijOQT7C:HMWY5GUUJctQ0lJhj0fg
                                                                                                                                                                                                                                                                                            MD5:639FB07F5333021E975C5491880AC135
                                                                                                                                                                                                                                                                                            SHA1:59442DCA3CE8C221A8D637FC04A2DFB92CC79DD4
                                                                                                                                                                                                                                                                                            SHA-256:EA207556D497A1FB09C5055AF10D4628F7D99283C9D70A8CD7C158B2A50E4F2B
                                                                                                                                                                                                                                                                                            SHA-512:29D8991A2BA3A6B31E1EDAE1481D527BFF88489C032B8FE860E581644E268C07D11C001407C348F6D3E2636E93904EA0B69894EAD421FBE561742725B968AE52
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....@...............................................................`A...............................................................p=...U..f...)......0....a..8....................Z..(...pv..@...............0....m.......................text....>.......@.................. ..`.rdata..`/...P...0...F..............@..@.data...`.*......6...v..............@....pdata....U..p=...U.................@..@.gxfg... D.......F...Js.............@..@.retplne.....`........s..................rodata......p........s............. ..`.tls..................s.............@...CPADinfo@.............s.............@...LZMADEC...............s............. ..`_RDATA................s.............@..@malloc_h.............s............. ..`prot..................s.............@..@.rsrc................s.............@..@.reloc..0.............t.............@..B................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_browser.dll.sig

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1471
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.586638491625096
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:+iCNV9ue/BbGNo7H6lah8keReriJ8gLIcO5v4Duvw5HjgTa/JDCcsO95hctTs7X6:+iCHMepSN078kfipLIckwFj8a/JDCcsD
                                                                                                                                                                                                                                                                                            MD5:052D06C606CCF18AAB5C01F8A2A9D7C4
                                                                                                                                                                                                                                                                                            SHA1:3A95EBBFB7514C7A65CBB7A7A19AF8F6879ED7FA
                                                                                                                                                                                                                                                                                            SHA-256:406D944F48E04F207D140BF7C740E416582C167248BDD43A95BFBB448E8A463A
                                                                                                                                                                                                                                                                                            SHA-512:F540F3FD6A2C3C47FEDB2D212F898E16D34CC0BE99988CC63B49BE87D5C98952836BFE8131744F4AA4493620BCD55E803683DEAF149545B19F5BA451F4DE1173
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:....0...0................K)..3...[.40...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...180627202339Z..280624202339Z0..1.0...U....PL1.0...U....DOLNOSLASKIE1.0...U....WROCLAW1.0...U....Opera Software AS1.0...U....DESKTOP1.0...U....DESKTOP PROD1'0%..*.H........wdzierzanowski@opera.com0.."0...*.H.............0.........x.....jn...)>a.....-} .v...P..S..x.>k{.........Tr..Yo.D....d.....l.v.wU. .A.W5..oor....-Vs.o.......yH.pJ...?.Whs0`....Jb....3/. tl..8c........C..Byq>h..3A8..{..p....\..n...Q.t....0mQ{j......U|.W\...........s!....K...'.....s..s....P..r8..........0..0...U.......`..\../X.l...e....w0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0...*.H..............D.G....gtpx.......~...v.....c..%.I.....c2Y.Y.....Y^..Aa..A.b.Y.f..Zra*.),K.....n.1r.C...Z...)....W.r.gu.Z....l......S.CF.m.Y...P.W..y.f.\,.$.>...!...FK....j....XHn.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2017176
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.454975663701389
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:LSehZsfmZ2e30YrwNBzMPummhgRfmbdIeiVd3D52t0ErERIjf:LlhZjvYBzMPnmEObcd3IyDa
                                                                                                                                                                                                                                                                                            MD5:F2FDAF82F5AA813C34BF1E4065AF7CFA
                                                                                                                                                                                                                                                                                            SHA1:7E59841CE56AE2529D4F57E37011415EA0EEB78B
                                                                                                                                                                                                                                                                                            SHA-256:31828C99997433649D8D093D722486BDAD349F3711C1160ADBF6276483020B97
                                                                                                                                                                                                                                                                                            SHA-512:A6667D2EFE9B7FD279104CDAA6DEA458E46299CB27115479854A31ED3F6D544340A30A4C36487CD2952338B3DF766680F9437055131C5CDB4BC538E67CDC0A85
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..................9.........@.............................. ...........`.............................................\................................)..............8.......................(... ...@...........p...........@....................text....~.......................... ..`.rdata..............................@..@.data...t............~..............@....pdata...............p..............@..@.gxfg...p-...`.......<..............@..@.retplne.............j...................tls.................l..............@...CPADinfo@............p..............@..._RDATA...............r..............@..@malloc_h.............t.............. ..`.rsrc................v..............@..@.reloc........... ...~..............@..B........................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_elf.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1155480
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.466423627842955
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:HLrpYA27tXtZXPUGRJLe6W1xyX9I54TCdf0Ms/WYfv5NuihoZZ:vpYA27RtZcGRJLHC49CSV1sZ
                                                                                                                                                                                                                                                                                            MD5:5BD857002A1FBAB40C1D40491AC060F8
                                                                                                                                                                                                                                                                                            SHA1:841CABC1755EED0D09C1091E51E1674818A359C4
                                                                                                                                                                                                                                                                                            SHA-256:A947B8113E36407FC9EACC90E9C3D32C7FB8D60DDD5574C0400A7E9DE40C33DF
                                                                                                                                                                                                                                                                                            SHA-512:42FFD6FCC197350BD4906D306DB4245A7F8AD24517ABDDFCD3DD652EDEB19D48D2E2C200687391DB0B6DCE538F0C17A6E020EA33356C5C94A37FD79B23E6769D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .........b...... Z...............................................^....`A........................................4?......8@..(....P.......p...s...x...)...`.......0..8...................`/..(....1..@...........XD.......=.......................text...]........................... ..`.rdata...... ......................@..@.data...............................@....pdata...s...p...t..................@..@.gxfg....+.......,..................@..@.retplne..... .......Z...................tls....b....0.......\..............@..._RDATA.......@.......^..............@..@.rsrc........P.......`..............@..@.reloc.......`.......b..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_gx_splash.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2171800
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.6646543375167795
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:XoqdfqcNskKxVecUoEdVUJz+MRKkwPPb98dilWN+cBzCUBhVBigOkzM4SepS8aBf:vfVKxV9jhVrRIPm11QgfoeyN
                                                                                                                                                                                                                                                                                            MD5:ACA58B5B93A4DA04F96FF535220BC75E
                                                                                                                                                                                                                                                                                            SHA1:0A615FD8E4C4E4ED0C4B412B37F60694A8CB3DA9
                                                                                                                                                                                                                                                                                            SHA-256:2A13EECFD9FD69536EF29019B680796B42E178707397D5BA0CC8776F3618B747
                                                                                                                                                                                                                                                                                            SHA-512:B6E00E594069BC18A5101128530FF991DC9130B3B9708793933CBA6DA6D5E17E3784127B82086273A711F0173BA0B1BFA8CD65D3B53E5645E2A066F352D10E10
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......F.....................@.............................."......)!...`.........................................3x..X....x...........M......Dv.... ..)....!.`...|u..8...................Pt..(....r..@...........x... ....w..@....................text....D.......F.................. ..`.rdata......`.......J..............@..@.data...l.... ......................@....pdata..Dv.......x..................@..@.gxfg...`)...0...*...f..............@..@.retplne.....`...........................tls....q....p......................@..._RDATA..............................@..@.rsrc....M.......N..................@..@.reloc..`.....!....... .............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\013E742B-287B-4228-A0B9-BD617E4E02A4.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5430
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.286080774872623
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:kfU8lE64vL97BnB/uBqKRxWo1suMbXWGG8Q:Q4vBFWx88B
                                                                                                                                                                                                                                                                                            MD5:91A97B1678EA6F166A6ADF4370BEC2E6
                                                                                                                                                                                                                                                                                            SHA1:2D4B52234F490887463B75DB53983F7133C6E46A
                                                                                                                                                                                                                                                                                            SHA-256:1AC6DBE3F6EE18BAA94EF8660B41528F7B8EF79148BC7B58C21485B85476A9A9
                                                                                                                                                                                                                                                                                            SHA-512:9D0855444968B4F4A777CE690776EAB00BF0DAA6AFD01B52BE96DFF2305572C133E1141FC79C07BC8DD4C739EC330813A7A737D7A7BAECEB46EBC35D33AB834A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?...?...?...?...........?...?...?...?...?...@.......@.@.?...?...?...?...?...?...........?...?...?...?...?...?.. @. .>...?...?...?...?...?...?...........?...?...?...?...?...?...?...?...?...?...?...?...?..+K...........?...?...?...?...?...?...?...?...?...?...?...?...?..........Uo...?...?...?...?...?...?...?...?...?...?...?...?..+K..........c{......r....?...?...?...?...?...?...?...?...?...?..............9W...........?...?...?...?...?...>...?...?...?...?..........+K...?..........9W...?...?...?...>...@. .?...?...?..Uo...........?...?..9W...........?...?...?...@.@.....>...?...?..........+K...?...?...?..........9W...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\07593226-C5C5-438B-86BE-3F6361CD5B10.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.560345262666608
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:Xg2aJpCnnYdmnnnnnL5S1Mk/UUUUAODLMRtJ178FNffwuGN7lOzQOnA+zzzzzzzf:X4Ra5S1M2UUUUxL6AfqUg+zzzzzzzM3s
                                                                                                                                                                                                                                                                                            MD5:74FDAC19593602B8D25A5E2FDB9C3051
                                                                                                                                                                                                                                                                                            SHA1:81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
                                                                                                                                                                                                                                                                                            SHA-256:F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
                                                                                                                                                                                                                                                                                            SHA-512:8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................|S..{R...z...z...V...|...|...|.......|...|...|...|...|...|...|...h...V...|...|...[...~...~...~.......a...a...a...a...a...a...~...|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................|...............................................................................<...............................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\0CD5F3A0-8BF6-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):17542
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.247918084411713
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:192:9dLhJ6/f2dh+xQLeZ10TLwhwOHae6nmErcglsIZS3F:3jaOdhQQu0TLwaOHEr6IZ
                                                                                                                                                                                                                                                                                            MD5:CA6619B86C2F6E6068B69BA3AADDB7E4
                                                                                                                                                                                                                                                                                            SHA1:C44A1BB9D14385334EB851FBB0AFB19D961C1EE7
                                                                                                                                                                                                                                                                                            SHA-256:17D02E2DB6DBEDB95DD449D06868C147AC2C3B5371497BCB9407E75336A99E09
                                                                                                                                                                                                                                                                                            SHA-512:30F8F8618BFBCD57925411E6860A10B6AD9A60F2A6B08D35C870EA3F4CEC4692596A937FF1457CEFF5847D5DA2B86CEBA0200706625E28C56A2455E6A8C121D3
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%.........................................E...................................................................................................................................................?...................................$...........................................................................................................................................................................................B............................................................................r...P..........................................................................................9...............-........................................................r...................................................>......................................................................$..............................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\1AF2CDD0-8BF3-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.17081824784348
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:Rf/uA/659Q444gqiz40zVKir4YiqT9944bUq4k4bUq49k44bUq4pa2q4CTGhUIcG:RuLKOUVKiNiYWS3hW2QK2IaqWI5
                                                                                                                                                                                                                                                                                            MD5:64AD26B9B9D8E4DA8CD564FE4843E65F
                                                                                                                                                                                                                                                                                            SHA1:9D1D05134F36EBA77ED18F725BC0CA2121FA2686
                                                                                                                                                                                                                                                                                            SHA-256:E5DCCC694E7F34DAF334B3A48B68DA450D5B34FE8A4E06842D864E99F400770A
                                                                                                                                                                                                                                                                                            SHA-512:5F77BF6EC0D46C99E02A268E63587C9CD552B61FDB55ECE3955B50CC470EC103B06B2360EDA86BD49AA45458E1885F7A4E8256DA7B47DC8B8B343BCEF5CDCEA1
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... .....@.......................................................................................................................................................................LVZ.G\e.................................................3u..PPP.PPP.PPP.PPP.:m..........................................Bbn.3w..OQR.PPP.PPP.PPP.NRS.+...................................PPP.E^g.....4t..PPQ.PPP.PPP.PPP.G\c.............................PPP.PPP.Cam.........9n..PPP.PPP.PPP.PPP.........................PPP.PPP.PPP.............6r..PPP.PPP.PPP.........................PPP.PPP.PPP.........LUY.PPP.PPP.PPP.PPP.........................PPP.PPP.PPP.....1y..PPP.PPP.G\d..|..............................PPP.PPP.PPP.....?gv.(...........................................PPP.PPP.PPP.....................................................PPP.PPP.F]e.....................................................PPP.Cal.'.....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\1CF37043-6733-479C-9086-7B21A2292DDA.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):15086
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.6549496934735806
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:jjXowmb64P5OOhw4SLGepPIOV+ZCreBKWoxBRAZLSFEnZIi:HYw85Of4SppQsaIJaRI
                                                                                                                                                                                                                                                                                            MD5:0342F103B6960E1565D24EABD5A6079D
                                                                                                                                                                                                                                                                                            SHA1:7C6C7EF5E86A83BC7FD75729BD641244CFFC8CB4
                                                                                                                                                                                                                                                                                            SHA-256:F92DC912529EB9D75655DC9C41557D2AF532425D1A6C8BAFB0879109C850F955
                                                                                                                                                                                                                                                                                            SHA-512:E37D8445CE9E0AE80E1519A11831075994F1F3255A85E8883F1CC171204DD3A4CC9560655E54F1AA27B4602A44B1FB4711AE352942319D6F0714F17AB48EB2D4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ..........................^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]0..T$..T%.._2..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..........\...^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..[-..........}..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...g..........Y*..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..W'..........g=..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]/..............^0..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..wQ..........V'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..V'..........wQ..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^0..............]/..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..g=..........W'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..Y*...........f..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...}.........[-..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..\/..........^1..^1..^1..^1..^1..^1..^1..^

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\2A3F5C20-8BF5-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):15086
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.1885512297205745
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:96:WzjWBglIZ/GjtT33fW57FL0ZyeaCRZi+/vL:Wzw/U/W579AXpL
                                                                                                                                                                                                                                                                                            MD5:2C40ED190AA02EB3A2CDC38B89F4458D
                                                                                                                                                                                                                                                                                            SHA1:F6E1F3E63098CCB207CBCF5127B7619AD294A4E2
                                                                                                                                                                                                                                                                                            SHA-256:FB15A61B133EC3333B377B947059550EC69304F0F9DA6FB333A54048F3E04E5D
                                                                                                                                                                                                                                                                                            SHA-512:1068EE61996222DCCD50C007BDC4A99D83DCC928E22AE845D27419952854A21B716878815FDA5747B75F1226DBC478F67AD9FCF177F80E326695D603B7FE7FAE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ................................a...................................................a.......a...........................................................a....................................................................................................mmm.>>>.............................................FFF.............999.....................................,,,.kkk.............'''.....ddd.............................................MMM.............fff.............................BBB.TTT.........kkk.................yyy.........................................###.///.............JJJ.....................YYY.===......................................................................... .........BBB.............;;;.............@@@.............GGG.............:::.CCC.............PPP........................................................................................................................................a......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\2F8F0E41-F521-45A4-9691-F664AFAFE67F.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5430
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2795862597625223
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:E9fPpk2cvduCWCiNSvjayBnHhtg4tlyQtaPkhb8GAoYFbKtgZaI5zQh6zKUtGUNQ:kfWFuCWq7BnB/iQ4PkhgDF+CZaRGG8Q
                                                                                                                                                                                                                                                                                            MD5:93E4504D4C585CFDA1979B37E75FE39A
                                                                                                                                                                                                                                                                                            SHA1:5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
                                                                                                                                                                                                                                                                                            SHA-256:69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
                                                                                                                                                                                                                                                                                            SHA-512:072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\3B6191A0-8BF3-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5430
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.6318458632047665
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:96:seB1UfVV/JYEQVg9Dpe/IV/OdBE0pVPU2rBvZjkLcH6bfid:s21U9VxqKDpeK7kVPU2rFicc6
                                                                                                                                                                                                                                                                                            MD5:9796ED786D95606D51BE9DAB54FB5350
                                                                                                                                                                                                                                                                                            SHA1:6EE48A6F912384D8F9CCE8BF7931BED779DC1D9D
                                                                                                                                                                                                                                                                                            SHA-256:74368197CB53191E522E3A73AAB974D53EAE8E38DA694A1ED2CFA06F39176E58
                                                                                                                                                                                                                                                                                            SHA-512:E9D14BA4486E73AB0FBB30F0C505E8AB2D8D5F55A3F87EC33AAE994F3B796EA415564136E70812B6ED09595D1BEAB345FEE1B7199694CE3F12118307065330D1
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:...... .... .....&......... .h.......(... ...@..... ...........................;.p.5.o.6.o.6Dd.0.........................................................................................d.0.o.6Do.6.o.4..;...;.p.3.o.3.n.3.q.3.n.3.r.7.n.5.o.6up.8Pn.7)i.2.................................m.3.n.6*q.8Po.7tn.5.n.4.n.3.q.3.n.3.n.3.p.3...;...;.q.3.s.4.s.4.v.5.q.4.r.4.q.4.q.4.q.5.q.5.q.5.q.4.p.4.r.5.p.4.q.4.q.4.q.5.q.4.r.5.q.5.q.5.q.5.q.4.q.3.r.4.u.5.s.4.r.3.p.3...;...;.t.5.w.5.v.5.y.6.u.5.w.6.x.7.x.7.w.7.x.8.y.8.y.9.z.9.z.9.v.7.w.9.y.9.z.9.v.8.v.7.v.8.v.7.v.6.v.6.v.6.z.7.x.6.v.5.t.5.r.3...;...;.u.5.x.6.{.7.y.6.y.7.z.8.|.8.}.9...;...<...<.~.<...<...<.{.:.|.;.}.;.z.:.{.:.|.:.z.:.{.:.{.9.{.9...:.{.8.|.8.w.6.t.5.t.5...;...;.v.5.z.7...9.}.8.}.9...9...;...;...<...=...=...>...>...?...=...>...>...>...>...>...>...<...<...;...<...<.|.8.~.8.y.6.t.5...;...;.w.5...9...;...;...;...;...<...>...>...?...@...A...A.................@...A...A...?...>...>...>...>...=...;...<.}.8.v.5...;...;.z.7...:...<...<...>...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\3BFDFA54-5DD6-4DFF-8B6C-C1715F306D6B.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):4286
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.1032077050059135
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:ylfbtHfEtPy/n3qq6kb57gg6AeOmm86JAAUw4HhcNh5VDc7D/:ypFs8BgxOmmH1Uw4EhvDi/
                                                                                                                                                                                                                                                                                            MD5:BD5865B6A3787241931895B562D1AAF9
                                                                                                                                                                                                                                                                                            SHA1:AB4636F3D534E11F8FCFDEA8A5070CD5D203F9C5
                                                                                                                                                                                                                                                                                            SHA-256:A81AD17502B90A50BB491911F35D44BEF0A855BDA2F9BFCD7D98868AD0678718
                                                                                                                                                                                                                                                                                            SHA-512:247766FE6585C0E965E7861AEDC48511CF825812B4C72345CB6FDBB148C3ED6A654C70D216187B4095770FB3BE1B5A18CD5A7289F5EE3BE0E6D01CB2AA12F40A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:...... .... .........(... ...@..... .................................................................(H. 'D.p'D.#C..'D..'D..'D..'D..#C..'D.'D.p(H. ........................................................................(D.@%E.'E..'E..'E..]s..]s..x...........k...5P..'E..'E..%E.(D.@........................................................ @..'D.'E..'E..%E.(E.`...............................(E.`%E.'E..'E..'D. @..............................................%E.0'F..'F..'F..(D.@.......@.........................'F.%E.0....(D.@'F..'F..'F..%E.0....................................(E.`'F..'F..(F.....&F.P#C..........F.d.F.d....s.z........3r..<...3x..&F.P....(F.'F..'F..(E.`............................%E.0'G..'G..(E.` @..'G.'G..B[.........F.d.F.d.E.Z.F.d.F.d.F.d.F.d.F.d.>...'G..'G. @..(E.`'G..'G..%E.0.................... @..'G..'G..(H.` @..'G..'G..'G..\p.........F.d.F.d.E.T.F.d.F.d.F.d.F.d.F.d.>...'G..'G..'G.. @..(H.`'G..'G.. @..................'G.'G..(H. P..'G..'G..'G..'G....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\4C95ADC1-5FD9-449D-BC75-77CA217403AE.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.0366948059247445
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:XEywkS4AG1drr8UDamI7U6lppC8CtucAXg78YDgPrmM9RzTEXMbRFA/9V6/:X5LBTrrnaVppstut4Daiw/EXa
                                                                                                                                                                                                                                                                                            MD5:3264B65E59E51CA4943AE076748BFCEC
                                                                                                                                                                                                                                                                                            SHA1:59AD003192DB03CA1E089924955FDCE0E25D159D
                                                                                                                                                                                                                                                                                            SHA-256:65944B9D2003DCB988A8E3E03D29074A8C142520431EFBA1CC115036A8072F47
                                                                                                                                                                                                                                                                                            SHA-512:7D81E6EE46A4389274C11178CB8E4CCF04BAAF1EEAD91BA44F27D7AF0290C55F55FBA2E7EC9E72DECA58D5138BA13238DCFB0956974E82059FE5285994090192
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... ...............................................................................7M$.*.(........................l......n.D.%.`...]R..P...A0 .4.%.'.)..................].........-.m...u...h...[...M...?.!.2.%.%.*..B...........v.........]w.G...........f...X...K...>.".0.&.#*...........<....................................H:..;.#.-.'. ...................$..................................8a#.+.(..}.................................................... .6.$.*.).......uj.i.......`........................................kG..*..........[.p}....U...........................................]fw./......:....oo...............................................4...........-...?...............................................'...........?...O...^.d.......................................1.E.........S...b...q.....f....................................................t.'...............n...FE..].........................................................0.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\5BBBDD5B-EDC7-4168-9F5D-290AF826E716.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.867292544398476
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:aRa8T7e6TkX4TLzYqQFTbondobmiSc/TRaRn4q9sldTu+R4mlyQRG/U0/2JBiEXs:8bDTVTlKvLRagLYmlyQR2aBiEXs
                                                                                                                                                                                                                                                                                            MD5:7868D43BE5BE8978E247DA73B69A50AC
                                                                                                                                                                                                                                                                                            SHA1:8F30676FF39D8A5DA69D2DCC624A6279FD323A13
                                                                                                                                                                                                                                                                                            SHA-256:FA6C55B1C6F924242A2EE556859BB935A2427320AFC7D2C911AD4192727662A2
                                                                                                                                                                                                                                                                                            SHA-512:52C174144A81B0218695FBB8F9152EEC917D914CD5DF2662A03706E161025FA962CDF4E952B42D990C254377B0B1A4B5B4B01AAF4E62AC6072847CE947252767
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... ............................................%...1...7...8...8...8...8...1...$.......................*...........................................................,.......@....Z...Z...Z...Z...Z...Z...Z...d.........$.................Z...Z...Z...Z...Z...Z...Z...Z...Z...Z.........1.......'.... o...Z...Z.. o...................Z...Z...Z.........8.......1.....Z...Z...Z.......................Z...Z...Z.........8......./.....Z...Z...Z.......................Z...Z...Z.........8.......#....@....Z...Z...d...................Z...Z...Z.........8.................d...Z...Z...Z...Z...Z...Z...Z...Z...Z.........8...........%........p... o...Z...Z...Z...Z...Z...Z...Z.........6...............B.............................Z...Z...d........./.....................d..................`....Z...Z..P..........#.....................Z...Z...Z...Z...Z...Z...Z...Z.............................`.... o...Z...Z...Z...Z...Z...Z.............-..................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\66DD4BB6-A3BA-4B11-AF7A-F4BF23E073B2.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):15086
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.1885512297205745
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:96:WzjWBglIZ/GjtT33fW57FL0ZyeaCRZi+/vL:Wzw/U/W579AXpL
                                                                                                                                                                                                                                                                                            MD5:2C40ED190AA02EB3A2CDC38B89F4458D
                                                                                                                                                                                                                                                                                            SHA1:F6E1F3E63098CCB207CBCF5127B7619AD294A4E2
                                                                                                                                                                                                                                                                                            SHA-256:FB15A61B133EC3333B377B947059550EC69304F0F9DA6FB333A54048F3E04E5D
                                                                                                                                                                                                                                                                                            SHA-512:1068EE61996222DCCD50C007BDC4A99D83DCC928E22AE845D27419952854A21B716878815FDA5747B75F1226DBC478F67AD9FCF177F80E326695D603B7FE7FAE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ................................a...................................................a.......a...........................................................a....................................................................................................mmm.>>>.............................................FFF.............999.....................................,,,.kkk.............'''.....ddd.............................................MMM.............fff.............................BBB.TTT.........kkk.................yyy.........................................###.///.............JJJ.....................YYY.===......................................................................... .........BBB.............;;;.............@@@.............GGG.............:::.CCC.............PPP........................................................................................................................................a......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\6D3582E1-6013-429F-BB34-C75B90CDD1F8.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.560345262666608
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:Xg2aJpCnnYdmnnnnnL5S1Mk/UUUUAODLMRtJ178FNffwuGN7lOzQOnA+zzzzzzzf:X4Ra5S1M2UUUUxL6AfqUg+zzzzzzzM3s
                                                                                                                                                                                                                                                                                            MD5:74FDAC19593602B8D25A5E2FDB9C3051
                                                                                                                                                                                                                                                                                            SHA1:81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
                                                                                                                                                                                                                                                                                            SHA-256:F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
                                                                                                                                                                                                                                                                                            SHA-512:8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................|S..{R...z...z...V...|...|...|.......|...|...|...|...|...|...|...h...V...|...|...[...~...~...~.......a...a...a...a...a...a...~...|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................|...............................................................................<...............................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\76C397A8-9E8E-4706-8203-BD2878E9C618.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.638581632319262
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:r+jdxX5GMV+VhezSDogEXMJBpLwuHzcg5Q7XIBAgv/lN:ruBfkYSDzEXMrSuryilr
                                                                                                                                                                                                                                                                                            MD5:15CC60C14626AE2549F3305C25B249F7
                                                                                                                                                                                                                                                                                            SHA1:A5DB46CDB09B46FD644BE78D2E3B798AE1C3DAEE
                                                                                                                                                                                                                                                                                            SHA-256:2D2E6EDAD6C27FD6BC79F2B02E15C1F8B227C1621536F902F065673FE03D0667
                                                                                                                                                                                                                                                                                            SHA-512:75BC0B4C13D40C253B796FEF48AAF4F9BF8C5981B20D287E740AD9950CD95CBAB32456E57804A907D68475C8E0E2B174A4964C9014849B6A84EAB658052E6812
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... .....@...................pn..b..%U.1#M.B!H.L!G.O!G.Q!(9..%&..%".......................)._]w..P...I./.E.>.D.H.C.K.G.E.N.;.^. .]u,.............. ...4...F.oEz..=...9.'.7.3.8.;.:.?.?.;.H.0.[...BX........... ...3...M...`.g=w..7}..5~&.4.0.3.4.5.5.9.2.C.*.V...(5B..........+...E...c...r.e8w..5|..5.5.5.=.4.;.5.6.9./.B.$.N|....o..........6...W...v...|.e7{..7.?.8.W.8.Y.8.S.:.J.<.>.F.,.Dl$..........#...A...i.......|.c8.F.:.i.;.w.;.w.;.q.<.h.>.^.D.L./\_..........*...M...s...}..:w.s9._.;.s.5.m.6.m.9.r.:.n.:.e.:.U.0M_..........+...O...i...k..{xW.5.P.0o..)i..(n..*x..,...,...-...{j...b...c'.fVU.?J..(I...9...lW.+K./)N..*h..*q..*s..)v..'...3v...e...o.............{....)....)G./+b..,w..,{..,y..+v..$u..E^z..h...l...z...................k.1/~..1...1...0....... h..]XF..i...k...r...~...............3..15...7...7...5...1....^..t^ ..h...j...m...q...t...w...x..v..8..1:...<...=...<...5...4q...`...e...i...l...m...l...k...k..j..4..79...<...=...=...:...K...~m'.}l&..k..v

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\8D754F20-8BF5-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6518
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.407909805152941
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:GyGuu/uu/uu/uu/uu/uu/uu7Z96wNYtmFoUaeqLC+QVclwHCx/fkjOYYxmrpIZM4:G6tT5wHuXkjOZaImFcOk
                                                                                                                                                                                                                                                                                            MD5:5E5293480F2EE9B15767E01F4D5DBAF5
                                                                                                                                                                                                                                                                                            SHA1:4AF378AE27C39DC0128EF2094A5E6B657ADB60B0
                                                                                                                                                                                                                                                                                            SHA-256:87CFD63B77DA23BF2B7C342F666138C3C35CEC7F2AABD51618447913AEE97DA3
                                                                                                                                                                                                                                                                                            SHA-512:3CDE31C1641B945BF1007AAE8468E815E29B1712AB877AAE2FE9C94A4AB3C1BF39F027A4FD113F962B466903E2550D52AD88E9AA5826BC66D96F43CA4AA8F3DB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .(...&... .... .(...N...(....... ..... .........................................................................................................................................................................................................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d.........................................................................................................................................................................................................................................................l...................o.......................................$......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\AD2FD2BD-0727-4AF7-8917-AAED8627ED47.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):1.6159828216175358
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:/tToyoOvySW1mLMB6yAHyyuyIyMByyMyCy+8Byyyuc7yyDByoBySyUyvyvywbsz:gOI/ysPh2/Tsz
                                                                                                                                                                                                                                                                                            MD5:58605FAE7FE4E695F5FD358A7465565B
                                                                                                                                                                                                                                                                                            SHA1:F47615D987B3F2D8FCE40DC93D55DEE71A78CDDC
                                                                                                                                                                                                                                                                                            SHA-256:831CC92E9F60D151B3446E5125AF5A8C45E613636D384324179AE565DFEC08FC
                                                                                                                                                                                                                                                                                            SHA-512:C045AC34FC39BBF1D7B108EB85165C57E551B47239D8A6515F7EC843C2AAE0CAEDA9E3E1CB919F1AED2FF9F98FF8D34934ED961ECEBCA1413A1FCBDA4F09343F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... .....@......................................................................................................................................*..........................................................h.......:...............z....................................................................................................................................................A...........,.....................................R.......T...............M..............................w..............7...............Q..............................7...............0....................................................................<..................................................................u...................................................................................................................u...............w..................................................................................................E...H......................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\B478FE0C-0761-41C3-946F-CD1340356039.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.994300674852024
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:QJTtCJ4Rge9BuHYjB2oOU7y5p3ygw1tXivSP3l3t:QJhK4R1Hu4N2o2j3DBm9
                                                                                                                                                                                                                                                                                            MD5:D2F1F9CE53773F7F51412AFFFEE0D97A
                                                                                                                                                                                                                                                                                            SHA1:748398747AAA25473BBB58353FCBCCB424E78849
                                                                                                                                                                                                                                                                                            SHA-256:00764980C4713198CBCDF7BD6A657BBAFFE15AE3BAA4E09A8EF19F32606BB6F0
                                                                                                                                                                                                                                                                                            SHA-512:010734637DCE084DBADD5C8D7A5ACC73FF262F37331AF4C9FD318310A12986917C647FFFFABF97C102C97A496D07CBF7F834DD358901D65DBC6CD77CD1F827D3
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... .....@....................................<...<.k.<...=...=...=...=.k.?...N...U...................<...<.t.=...>...>.d.=.?.=.?.>.d.>...E...[...V...G.4.........<...<...>...>...................................E.j.A.1.........<...>...?.......D.+.G.].H.y.H...G.y.E.N.D.......?...=.......<.+.=...>. .@.o.C...H...L...N...N...L...H...C...A.<.?. .>...<.+.<...>.......B...H...L...O.Y.R.4.S.6.S...O...H...C.......>...<...=...>.;.....E._.H.......... `.. _.F.\...U...M...F.......>.<.=...=...=...............X.0!b..%j..%j..!b...X...P...J.B.....>...=...=...=.......J...P...X..!b..%k..%k.."c...Z...S...........>...=...=...>./.....G...M...U...].."b.."d.A!`...........H.......>./.=...<...>.|.....C...I...O...U...W...V...S.'.M.e.H...D.......>.{.<...<.@.>...?...A.Y.D...I...M...P...P...M...I...D...A...?...>...<.@.....<...>...?...B.).D...G...I...I...H...F.^.C...@...>...<...........<...<...>...?...........................?...>...<...<...............<...<...>...>.}.>.0.>...>...>.0.>

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\C665D993-1B49-4C2E-962C-BEB19993BB86.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5430
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2795862597625223
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:E9fPpk2cvduCWCiNSvjayBnHhtg4tlyQtaPkhb8GAoYFbKtgZaI5zQh6zKUtGUNQ:kfWFuCWq7BnB/iQ4PkhgDF+CZaRGG8Q
                                                                                                                                                                                                                                                                                            MD5:93E4504D4C585CFDA1979B37E75FE39A
                                                                                                                                                                                                                                                                                            SHA1:5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
                                                                                                                                                                                                                                                                                            SHA-256:69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
                                                                                                                                                                                                                                                                                            SHA-512:072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5430
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2795862597625223
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:E9fPpk2cvduCWCiNSvjayBnHhtg4tlyQtaPkhb8GAoYFbKtgZaI5zQh6zKUtGUNQ:kfWFuCWq7BnB/iQ4PkhgDF+CZaRGG8Q
                                                                                                                                                                                                                                                                                            MD5:93E4504D4C585CFDA1979B37E75FE39A
                                                                                                                                                                                                                                                                                            SHA1:5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
                                                                                                                                                                                                                                                                                            SHA-256:69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
                                                                                                                                                                                                                                                                                            SHA-512:072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\CFCE84E5-9A95-4B3F-B8E4-3E98CF7EE6C5.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 6 icons, 16x16, 2 colors, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):34686
                                                                                                                                                                                                                                                                                            Entropy (8bit):1.1787188557524333
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:ENq56QHucrYU+uLvYnF+y8JJ34uRzDXojiYjgHLZ4c2kFSAfhGVVwVv7BABQ3jIz:QFcvRxl4TjMFSA5G0BABX0NB90gQBtBZ
                                                                                                                                                                                                                                                                                            MD5:5337074698C608F4996D7F6AC571DBB9
                                                                                                                                                                                                                                                                                            SHA1:66CB3910242DDA40A4E17C76FDC73829C8DB99BD
                                                                                                                                                                                                                                                                                            SHA-256:B3C8A7AA2BC429AA15A764574D7C7D54F2672628DFF75CA830A5DB4CBC878B3D
                                                                                                                                                                                                                                                                                            SHA-512:D48AF3344304FFE613511529C227F0CDE3443C6409F14058D3E381754D6FE9295B71332840BBE8D55EFE40C893AB0513B15C70EC36008844508BA4FCC8E492DB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:..................f......... .h............. .....~... .... .........00.... ..%......@@.... .(B..VE..(....... ...................................3........................................f..8........................................'...........s...1.............................(....... ..... .....@...............................................................................................................................................................................................................................................................................................3..n3...3...3...3...3...........3...3...................................9...3...3..o............3..43..)3...............................9...3...3..p................3...3...........................3..,3...3...3...3...............3..q3...3..>................3...3...3...3..O3..Z3...3..*........3..$3...3...................3...3...3...........3..93...3..X........3...3...3...........3...3...3...............3...3...3.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\CFD4BE41-4C6D-496A-ADDB-4095DFA1DD0E.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 2 icons, 16x16, 8 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5686
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.499087745233182
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:96:DU/TAAAAg50UqaoAQsOcRtzXoX6UDQU0U/F:grAAAALfaoAQxozXoNF
                                                                                                                                                                                                                                                                                            MD5:CAE06CD4B5B7BE327CCB00A6DD6F588C
                                                                                                                                                                                                                                                                                            SHA1:91AB18740E8C44D89F0C66485DEE5E616999921B
                                                                                                                                                                                                                                                                                            SHA-256:0031AC87D8B67D608BF586EE097204782580EE645891C5D3D05591AE00F47953
                                                                                                                                                                                                                                                                                            SHA-512:AD0DEEB131E9D78A58E0C61F0433F06332F0116129EA55F16739FF2C6A3767F5082500152B98273140296B8A8F1A7CAF984289AF5D562969B2515143E75E48B6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:..............h...&... .... .........(....... ...........@............................2)......7..............le..TL..............vo..e^..........g`......}w..........zu..............E=....91......YQ..[T...........z..........>6..OG..ic..........]V..b[.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\F3F34CBB-24FF-4830-9E87-1663E7A0A5EE.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):15086
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.6549496934735806
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:jjXowmb64P5OOhw4SLGepPIOV+ZCreBKWoxBRAZLSFEnZIi:HYw85Of4SppQsaIJaRI
                                                                                                                                                                                                                                                                                            MD5:0342F103B6960E1565D24EABD5A6079D
                                                                                                                                                                                                                                                                                            SHA1:7C6C7EF5E86A83BC7FD75729BD641244CFFC8CB4
                                                                                                                                                                                                                                                                                            SHA-256:F92DC912529EB9D75655DC9C41557D2AF532425D1A6C8BAFB0879109C850F955
                                                                                                                                                                                                                                                                                            SHA-512:E37D8445CE9E0AE80E1519A11831075994F1F3255A85E8883F1CC171204DD3A4CC9560655E54F1AA27B4602A44B1FB4711AE352942319D6F0714F17AB48EB2D4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ..........................^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]0..T$..T%.._2..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..........\...^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..[-..........}..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...g..........Y*..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..W'..........g=..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]/..............^0..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..wQ..........V'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..V'..........wQ..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^0..............]/..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..g=..........W'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..Y*...........f..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...}.........[-..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..\/..........^1..^1..^1..^1..^1..^1..^1..^

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\F98D4D4C-8AA7-4619-A1E7-AC89B24558DD.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.5312914343989297
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:wiamjx12wm3v23BJ37IE0K4cDm6H/HGtaYiBn:wi5xYlO3BJrv0pyxD
                                                                                                                                                                                                                                                                                            MD5:192A42730EEA5A6A3238F50285F01010
                                                                                                                                                                                                                                                                                            SHA1:28FC94448C726E0D62375942866A1FAFC916F61A
                                                                                                                                                                                                                                                                                            SHA-256:4515919BA9C8A1AE19DEAE230F2FDFBB94DE5C29753DC3FB7C2A877B474F4F0F
                                                                                                                                                                                                                                                                                            SHA-512:B680B643CC66B7687108C34ADBE80996851A5B24BEAE2E7EA58C8C8AB86D4900DF12D5A4E8380186A53D7A46F923B6A4D7DB46555C5BCB0F90021DDA10D4568A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... .....@..........................f............j...=...................................................<...s??....................g...!...............................................*...q.................N.......................................................|..........._.......................................................v...........................................................%.......................................................M..................q...............................9.....................................................J..............................i.................................................n...;...............................{.......................4.........................................................................Y...........................C..................................................................Q.......................................................................K.................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.560345262666608
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:Xg2aJpCnnYdmnnnnnL5S1Mk/UUUUAODLMRtJ178FNffwuGN7lOzQOnA+zzzzzzzf:X4Ra5S1M2UUUUxL6AfqUg+zzzzzzzM3s
                                                                                                                                                                                                                                                                                            MD5:74FDAC19593602B8D25A5E2FDB9C3051
                                                                                                                                                                                                                                                                                            SHA1:81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
                                                                                                                                                                                                                                                                                            SHA-256:F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
                                                                                                                                                                                                                                                                                            SHA-512:8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................|S..{R...z...z...V...|...|...|.......|...|...|...|...|...|...|...h...V...|...|...[...~...~...~.......a...a...a...a...a...a...~...|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................|...............................................................................<...............................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\FF57F01A-0718-44B7-8A1F-8B15BC33A50B.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5430
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.6877369236023396
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:1sBM4boY8LQhIjtT25y1X82YDb+v/TcYMdILyMh6QpdG8Q:Gi3H/jR25y1MRbSrXMadhPpEB
                                                                                                                                                                                                                                                                                            MD5:4CA6A47462D19D539F9A32B702B10177
                                                                                                                                                                                                                                                                                            SHA1:1F53B02309B901C8E7CC20F8640187F4F185F393
                                                                                                                                                                                                                                                                                            SHA-256:1BACA3300AEA9840985CFBFBAF1622BE00922BA193168C1FC4246BDB8898F217
                                                                                                                                                                                                                                                                                            SHA-512:E08A0013A7D8664CBBD88EAA1235A27704DBB4BD13D849D45B3A529F7373844D67C11A2B13881823EF6586840980B670C8FB278CF220D1093976CD00148CA2B6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................u.].X.:.W.9.r.X........................................q.W.S.4.S.4.S.4.S.4.S.4.S.4...Q....................0........p.W.S.4.X.:.................D..A...f.........................K.H.V.8..........................F..B.....................6.......................................B..............................................B..B..B..B..B...s..........................................B..B..B..B..B...z.................5.................................................................../P..9G.................................................0........Wb..5C..;I..................P\.....................0................Wb..5C..5C..5C..5C..5C..5C..kv..........................................\g..:H..9G..[f....................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\FFF3F819-B6CE-4DE6-B4E4-8E2618ABC0D9.ico

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1150
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.9160268464631507
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6:DCA7VYhkLd2lrgxafa5l5ayJsPMcyEwmM7Zo72JOU1nMOkaWLSDuvw4/lMl:eMYhkcKaf0SyGPvyEM1o6FQao9v7tMl
                                                                                                                                                                                                                                                                                            MD5:72460DF2C3C16ED7FFFA3988F5E86CBA
                                                                                                                                                                                                                                                                                            SHA1:B17DACC408D124A0AEF2650A92F3C0AB2F9D4F54
                                                                                                                                                                                                                                                                                            SHA-256:8D2A443307CEBA1D996D0DDAF5FCE63B838B5DAFA6F09AAEFF2D83127F38DE01
                                                                                                                                                                                                                                                                                            SHA-512:516720411D964823FD88A63BB1B0AD49F8A98BEE03D13CCDF23EB5775C8B4A02E743D099A481573C02B311B27E447F646DEEA5AEB6066FABF38EFFE96E712876
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............ .h.......(....... ..... .................................................................................................................................................................................................................................!.......F?..................................MG..............................OJ..................................................................ZT......................................................( .............................."..................................."................................................................................{..........................................UO..................................................................ZS......................................................93...................................&.............................. ...........................!.............................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\ab_tests.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2561
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.511287976109681
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:y4ktq43DntwhkNLyxnt2toyNntSGyNntiSyDntz1n:L/uDnKhkNLyxnI6yNngGyNnESyDn51n
                                                                                                                                                                                                                                                                                            MD5:1A9CD4E4812B2D130CA45228BCB33700
                                                                                                                                                                                                                                                                                            SHA1:10A4DA3CDBE3320CA8DE96C810AF22576333B2F0
                                                                                                                                                                                                                                                                                            SHA-256:C42F8D9E12DB61B769D6D8D345CECD6668EC4847C80A107910BBF87530223C32
                                                                                                                                                                                                                                                                                            SHA-512:FF13EBB69177190393F62528216F05170BD68A2E2A3CA511DDD92E40ACABABDB5CC002FB546ED8451FD952F1FF2FD4A6C93658DF3FCE987D7193B1F1D9615CC2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// tQtPYzJXnVa9SzjE0kXvU4xD/vLOQ3hg9wx9hzaCwIr7vvWyxsfKcoeBDzRhH32rMbTc8JdyS136pCaw/VzcEkpqwBXdOAhorEbiIX/gdISGtTN+l0c0xcOi4TVRtVh9eZ0PXwx9DhHn9UNOg9blF6mFcTxEWtnio8SP17o7RjmUzXyw7Vgxkq05I6iDTeLJYSIa9Ioe5a78EoKeWmPNX6Q/1/5Ga55FcZ+O44k9Fvbneuw1z17PhBMhe7zD+4dW6t38GaYX4wFVaVuiI34KLCjpUi6X+nsjkYjbhxuLAHVZyMZhYjgin24+CN/nRM8ohfN2U7ZCthbfHT71KSQI2g==.{. "version": 2023102301,. "tests": [. {. "name": "DNA-93212-ru",. "total_test_percentage": 20,. "country": "ru",. "test_state": 1,. "test_groups" : [. {. "name": "DNA-93212-test-ru",. "preferences": {. "gx.show-yandex-in-mid-profile" : true. }. },. {. "name": "DNA-93212-ref-ru",. "preferences": {. "gx.show-yandex-in-mid-profile" : false. }. }. ]. },. {. "name": "DNA-99214_GXCTest10",. "total_test_percentage": 10,. "test_state": 1,. "test_groups" : [. {. "name": "GXC

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\automatic_search_users.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):942
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.365075590948008
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:jjh9ucSirU6JuA6yACzw4dpK5PJhl5hZH95M+53guG9SPpT:GcVvX44dpKDhl7ZH9S+JAYPpT
                                                                                                                                                                                                                                                                                            MD5:3F23A58366EFCF350F97FB2039D19A08
                                                                                                                                                                                                                                                                                            SHA1:E1AFAA9A0967F20596CBCC2DDC27FB497DA7803B
                                                                                                                                                                                                                                                                                            SHA-256:E164E2345B5D2D9517F3F7EF29C6545A3454E0F5A85534922C667A5B9363EF54
                                                                                                                                                                                                                                                                                            SHA-512:8F74BDF911FDB967CE770B1C2D782AC9138259996734E7D9C79162949A892220DA100AF84C93D08B78BE43BE8D6EA6E1DCA7E7BC74829565F0D529926BBA63A9
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// ZtPMo8xDsbWJZILs9caSS58+1y78u/Q9gs9oW/WduaHOI7TixLchZ27GapPvRcrtMkHnkk4CdQek54Tsaj+kwUQKLEtgxR8PUfnKhqXuiLNxc0j+4xGzoB0nt+2fQDgRKYV2+o8D2uVuIaBSyCvsG663H3XUKcyXYEs7K10tEs+3pqTvjpYrN+uVDSiPp5B3EThc9crgRFyKW4lPzogZaJdbLwZ+sT+DaSpg2m/GPSjl6WqIfQXiM9YPl4IwIBT7noueywK0mbDl9iYKW167d17T1LQNyIoi06BYDCgsPGD87wsY6cjrE09JZsUCZHe7Vpjrr6UQ/pOfj5PEDq9f5Q==.{."version": 3,."list": [. {. "url": "https://redir.opera.com/amazon/",. "short_name": "Amazon",. "color": "FFFF9900". },. {. "url": "https://github.com",. "short_name": "GitHub",. "color": "FF000000". },. {. "url": "https://istockphoto.com",. "short_name": "iStockPhoto",. "color": "FF000000". },. {. "url": "https://x.com",. "short_name": "X",. "color": "FF000000". },. {. "url": "https://youtube.com",. "short_name": "YouTube",. "color": "FFFF0000". }.].}.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\browser.js

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:C source, ASCII text, with very long lines (347)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):19607
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.2813674139671045
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:192:4wYMZFMHRmDzq9I7oKDnBiSzEFGgZRPMA+JHwhHDX7m7mCyiRHI4UIA7m72YCyiw:3MDI7oKDnBnwGgZRPTTJU
                                                                                                                                                                                                                                                                                            MD5:5921393A698835DAD4973DA46A8C9118
                                                                                                                                                                                                                                                                                            SHA1:136BA055A6ADB8DCA23B3828C625F058DCAB8044
                                                                                                                                                                                                                                                                                            SHA-256:90F1612DADD5E482B6A0ACADE6AF8C074F8CF967CEC8D18BAE6C1FB52D538F5E
                                                                                                                                                                                                                                                                                            SHA-512:C2CA846ABC62D5EBD9E47533BF3711FF2A2F48C0DB258B6662AD0F3EDF165F83A83FFF0469FBEA8B63859AFCAB40FC4F590C9EC5F496B8C08BBBB7B00EBB360A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// ANhamdsT/5FFQOpBSSfsSzXWPKaFcuo6fRFv47H6WwIDueS5K5yIJ65R3TQ3ArO4sFsz/UN9fqwaJvX728bxGvrbC1Qt0L2n/xQVovP9oG0ORe55wCN7YV/aB4jd5OlIJqiBIoUIYh0wX8K3rDds2k25NijYQCl+IdAXqMJUeBMPktA6SPMV2F/4iO1OJPFjmDG2s+v+4mypZjKAXifR8CYDZFTsTQ95QNtsWvszTtUpdNJ7Pkwh3GALldAtgEXwWaLbC/0VBPxcA45VF4jySpiZeic3H1jgje94PnvkSNDqbwA4tvARyfrH4Ht4iA/lbKOrAUfAi/aDAcAZHZu4yw==./**. ** Copyright (C) 2024 Opera Norway AS. All rights reserved.. **. ** This file is part of the Opera web browser.. **. ** This script patches sites to work better with Opera. ** For more information see http://www.opera.com/docs/browserjs/. **. ** If you have comments on these patches (for example if you are the webmaster. ** and want to inform us about a fixed site that no longer needs patching). ** please report issues through the bug tracking system. ** https://bugs.opera.com/. **. ** DO NOT EDIT THIS FILE! It will not be used by Opera if edited.. **. ** BROWSERJS_TIMESTAMP = '202404041142'; // for versioning; see DNA-54964. **/..'use str

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\continue_shopping.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3079)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):159972
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.08509752046205
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3072:KVVPEisdWIPyccrg5rXou92Q0ZNeZYwex3XxqfCcL3suVRHLfLnLILs:iccrg5rXou92Q0ZNeZYwexn+HbrcLs
                                                                                                                                                                                                                                                                                            MD5:4932BC39E540EDF6F257154DD6642A87
                                                                                                                                                                                                                                                                                            SHA1:3CBCC6A06796513A605D4F4C6E662213ADE911BE
                                                                                                                                                                                                                                                                                            SHA-256:C79DB69B234C3886C4AD0B73A203ACFE15BC8E8382F4FA4E6A5E78C6CDC45607
                                                                                                                                                                                                                                                                                            SHA-512:DDBEFDE8D66DE4FCCB99E5212D4F08230B4DBE82A815BE22FD8EDCE22C9CDCBDC0BDCC4A45E9C8C0C04634F658F84A7F944CAAF4C5BAB7AD97C0CB8BBC310FA9
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// ACBmtoCIjfrw1GiE40PTqisc+nBGUkeyOySvFKxkt2F/Sb+UazUpMxaetnu1AgYREo6WpCf6WtunjeBaSzbaTKIxy1WJP2EPnkhlfGvJGc4a+7YxnqSIsd1z712rcHBiBknEzcNNPgjhnCTtICto8ED85wYdD8VrvkHCYfy6Z0tyErEJqQMfC5HwVL/Kaa8BpUvV/C4prLWL6b0jacaKPynS99p+eIYn0o2Aa4W7xG+Fpn/E3PxgWnqz3BjHopQ+bu84K7eoiL6QcrvJzmM9ZMI+Fxx1/55vy0o4NVJ1eC85tYXgaDAwfYIk6aSdwSXWxa+plelbonkwj3aiatFLSQ==.{. "version": 14,. "partners": [. {. "partner_id": "aboutyou_at",. "partner_domain": "aboutyou.at",. "product_url_pattern": "\/p\/.*",. "product_history_pattern": "\"aboutyou.at/p/\"",. "partner_icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAAAclBMVEUAAAD////4+PgYGBikpKQmJiYLCwvi4uLb29tLS0v09PTp6emCgoJra2tcXFxJSUnr6+vJycmKioo6OjojIyP8/PxfX1/6+vrMzMyamprf39/S0tLR0dG9vb28vLxDQ0MfHx8aGhrd3d2GhoZ3d3dFRUWvj4E8AAABVklEQVRIx+1VV5bDIAy0wcbg3kt62b3/FTeUZ+EW7Yt/M5/SSIyEEM4Xn4L5lRCVz/7Hpq13jEJCwujotRSl1yVv3BENL+v3/OThzsCTd2o84i5AvE1dt/NIyoMgH4PPt438F8Mu4syn1M/iwsRc1s/wtLdP2dje1JTkrdbbqfSDne0a6IBup

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\custom_partner_content.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):242304
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.028776242997077
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3072:+lrEaq+nSpKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:cEe+1btUYOnkrPVZCCUCabNU
                                                                                                                                                                                                                                                                                            MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                                                                                                            SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                                                                                                            SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                                                                                                            SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_users": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\daily_wallpapers.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):72163
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.601891206052405
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:768:sgypXfnu++bTNwGeJdhnagcsBVG/oggB1PqMvYv9Jq6AaR8PgwKsbtx2301bf1Ew:6
                                                                                                                                                                                                                                                                                            MD5:9DA90B26455525B2331FB64ABD1B0D60
                                                                                                                                                                                                                                                                                            SHA1:592BB5CFCC9DF4126BEE2AC5464703D180789AC3
                                                                                                                                                                                                                                                                                            SHA-256:924BD0C85221070ADAA23138C911C55AB29D84279782FE937D1E70407CC22C66
                                                                                                                                                                                                                                                                                            SHA-512:D058B76007FD7568E23E351C96E8F34AF639D30DC0633052CBE8A094598E3F74D90E81DAE9EAA5AD96988F3CC2157A249927F0D015104666449C5D116E256CFF
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{. "daily_wallpapers_schedule": [. {. "wallpaper_id": "mods/kaandijoelepfajcbaglpnacgmebonpc/smart_wallpaper",. "start_date": "2023/9/4",. "end_date": "2023/9/5". },. {. "wallpaper_id": "mods/anlamljaonmlkmfaipamolamdpjobldl/smart_wallpaper",. "start_date": "2023/9/5",. "end_date": "2023/9/6". },. {. "wallpaper_id": "mods/eaahgnceaiheanheajmiojafolhdfbih/smart_wallpaper",. "start_date": "2023/9/6",. "end_date": "2023/9/7". },. {. "wallpaper_id": "mods/dafbhaiokkmgdlcpiblejdpgcnipgljh/smart_wallpaper",. "start_date": "2023/9/7",. "end_date": "2023/9/8". },. {. "wallpaper_id": "mods/jpghigceifbjmaommcoeheogkbphlanb/smart_wallpaper",. "start_date": "2023/9/8",. "end_date": "2023/9/9". },. {. "wallpaper_id": "mods/eggjmmfhnmejmopboifholjgiekialgf/smart_wallpaper",. "start_date": "2023/9/9",. "end_date": "2023/9/10". },. {. "wallpaper_id": "mods/naabgogikghh

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\default_partner_content.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (7765)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):264023
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.046604587789893
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3072:Om3VKW6kjnxEaacB+5RKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:JtE/c8Z1btUYOnkrPVZCCUCabNU
                                                                                                                                                                                                                                                                                            MD5:1653A81266A9F150AFB443E8A276ED31
                                                                                                                                                                                                                                                                                            SHA1:C2F2E827110AF5779C4A732A6B0E83F108C0B152
                                                                                                                                                                                                                                                                                            SHA-256:A56634EF3A23D92632C561DA87D94A912BDDF22958406FD8E57E41F3B6DFA213
                                                                                                                                                                                                                                                                                            SHA-512:450822B96E6EABAF55FF1E39CB199E9CCC4F6BA038C0E9100AFAFEFBCE1846606CBAC8FD1CADA2C63AAC23BEED598099F5419E2DC496C790948CF5C085F02E53
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// c3ljDFQDEIPksoQdB6EKdLFNtsySS2Jm21w+xl2LFdESFwpBtJKZuHmZ6yjleKq8vAVDz3+1U1n400L+DaxYoNhcvBUneuuIK0QUj/wYIYYPk+2TM7MeqhbiFffO4UIn6TyEw8P0zfp3jeN+eVfPJgzVx/NAAnsiySEXuu8t7rgmlPOTTe3EXiYmcqEEoqXC9X4KWHiz5jpNdMG1SojhIT4fbjcygYzYcZxElxZ9De4fIzWxbQwlsDRuftkTfJaJAn34I36OVVsZmHphCokWCJ3CGUYl6I8A7a24nzZkyRVrzuot0IC8Ris1FOiXOcgcnzdAofRgIuW8zqrls1snyQ==.{. "version": 126,. "search_users": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "at": {. "other": {. "list": [. "google_com

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\doh_providers.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):801
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.495629414250427
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:+Y01zxc7Un9fG0M/MBh3ILSXaiSmAXSqA/Cj8:j2NkUtG5/cnXazmACjCj8
                                                                                                                                                                                                                                                                                            MD5:4F98A7320537B24179D9860246E2D840
                                                                                                                                                                                                                                                                                            SHA1:B727FDB4D25AA07E02464EAB8DAAE4DC663ED298
                                                                                                                                                                                                                                                                                            SHA-256:574421B40CF123844F55A0A72AD5EC0BC9DEA3C8D823F8B7EC065D7B7C346175
                                                                                                                                                                                                                                                                                            SHA-512:3F6273688F25D375974A18E554339B7F3E2F0BCEE19F31E265DD6256C3514A23B4980D4F2182A69AD5ADA95A2CAD8F94AC04B510A26954392626EBD28F54E5B4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// ia96yydt8bWv3y5ivc46+PdnIQFXt6cwopEjrrZk+GzzrDKmMzcyxK7YvTbpmIQjCw/QjXke1u1o3WiWeFr5+90QlOeWBJnZjzqILeh/ogmgCbB7hcNIVL31zrGZF+EyVVFZVRDsBx6pLCX3DEHKGrXNOb9epqcY2EwwM0goOtSqFoc+wlNrDRNwVOVT4GQ05GKThcHzHWSMu0DzC8Yd2II64XSFBsDM9U+HlrlASNhELQ31db0HJL0EWMcQc4sFM/DixX7TPvU/oKX35liQk8HEVxVrxhm612/tW8rZ54zab/O3RW1LE/23aLHU5jslgAI36CGRvXFeXlfeA51jJA==.{. "providers": [. {. "url": "https://cloudflare-dns.com/dns-query",. "ipv4": [. "1.1.1.1",. "1.0.0.1". ],. "ipv6": []. },. {. "url": "https://dns.google/dns-query",. "ipv4": [. "8.8.8.8",. "8.8.4.4". ],. "ipv6": []. },. {. "url": "https://dns.quad9.net/dns-query",. "ipv4": [. "9.9.9.9",. "149.112.112.112". ],. "ipv6": []. }. ].}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\domain_suggestions.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):11626
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.0888959569937775
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:192:zvfkeB8VFTwnWIZaV3HFpVcluOlHMyywPhRmeOJodu399EGZMPtP:zvPgRxIZS3HFXQuOlHMgRmD6e9GCsd
                                                                                                                                                                                                                                                                                            MD5:2F5136C14D7DC6E3CC79C6B54510680D
                                                                                                                                                                                                                                                                                            SHA1:5187CE8D7897FBD9392B566576998DFFF33A3E6A
                                                                                                                                                                                                                                                                                            SHA-256:6AF202C1D4FF3D20505814D3018748562BD67A44615D686DC316088A77229119
                                                                                                                                                                                                                                                                                            SHA-512:A9398C09D70D14A09682778BFCC5415EA3539F960A44FC6B4FAA2F7C3F4E1C368525EE889696E6428297DCFB1F33B188AC12578352F725E81F0DB6938BC11F8B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:[. {. "url": "https://bestbuy.com",. "audit_id": "T57wbw2aOJR9jxXRgj+sZKk8FsoXHqe4TZddvID+93o=",. "title": "Bestbuy",. "favicon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABwAAAAcCAIAAAD9b0jDAAADaklEQVR4nGL5//8/A7UBE9VNHDV0WBr6////f//+EaOSBUL9/Plz7YbNL169YmRgFBERdrSzuXr9xpVr1yGyUhISRob6W7btfPHqla62FjcX14NHjyBS3FxcoUEBwkKCWAz98fPn0lVrbt++qyAvd//hw2MnTjEzM23ZtlNZWZGLk0teTnb77r2Hjx5XkJf79OmzhLjYkWMn7ty7LyggoKej5e3hhmYowvuMDAxc3FxGhvpsrGzMzMyMjIwsrCxG+voOdtZRYcE/fvxgYmLU19WOCgsuLchtqq3k4uR0tLed0t8lLSWJL0y/f/t++85dFhbmr9++ffny9c+fv5evXjt1+uzff3/zszOsLS327DtYXFl35vwFLi4uBkYGNlZWHm4eJib0iEHh8/Hx+nq6S4iLHztx6vHTp2xsrK7ODiGB/r9//3n58pWxob66msqr16/v3rtPVEQxMTGJCAu/fvNuzoIljEyM3h6uDAwMnz59WbthMyMjo6KCvLCg4JHjJ3/9/mVhZmJvY/Xz5y8JcXF+fj5GRiyGMkJKqX///r189frSlaunz5xjYWWVkpSQl5X99//fkWMn9HS0FeRlT54++/nLlzdv3lqam/p4ul+/cWvj1m3Wlhb2Nlb4XCopIb573/7ZCxaLi4n++PGTn58vwNdr/uJl+VnpUlISE6bOcHGwf/P27dETp6QkJWfMmX/56nUfT3es3kcJU0jRamVhrqyk+Pnzlx8/fv4HeQQM//3n5+dPSYh7/+FDaXX94WMnwoL9tT

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Black.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter BlackRegular4.000;git-a52131595;RSMS;Inter-BlackIn
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):414140
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.13273327924002
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:s3unFMi82w/+qnJWPziKSQSzzY6XqYQ0rBfmPbPGxGl36DNoAmFFhGj3k4yhP18:s3uV82wWqsPziK4zbBOPb96DNAV8
                                                                                                                                                                                                                                                                                            MD5:4154321279162CEAC54088ECA13D3E59
                                                                                                                                                                                                                                                                                            SHA1:5E5D8C866C2A7ABFD14A12DF505C4C419A2A56F7
                                                                                                                                                                                                                                                                                            SHA-256:6BDEBEB76083E187C7AE59420BFC24E851EDB572E1A8D97C1C37B7B2DC26148C
                                                                                                                                                                                                                                                                                            SHA-512:04CA175774CBE3F2D83543C01CC388E2715AB7B1378143DB41BACDC7E7EDDF05D3BEEF476F6ACBE7DDEB34861984EFB5FD7F299EC1820697C440B372D258AEE7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOS<.,... ..@.GSUB..B..F...]@OS/2 .....\...`cmapL.........d.cvt P.....A....&fpgmb/....B.....gasp......A.....glyf.3.J......U.head0%.a..^T...6hhea......^....$hmtxE.)...^...-.loca.;w....h..-.maxp.t.....$... name.i-....D....post}.........xprepldhL..P..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BlackItalic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter BlackItalic4.000;git-a52131595;RSMS;Inter-BlackIta
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):422324
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.159556140030877
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:PtBc7UQ0dNXWqSBQVUWrqIWqH70TVMYydoAF4N0ELhwnftLu+hNHzFxo5spvD3+p:Pt2+dRWqgVrwYygLhwnfhjh9fZ78
                                                                                                                                                                                                                                                                                            MD5:C5C41F7587F272A4C43A265D0286F7BB
                                                                                                                                                                                                                                                                                            SHA1:916224C963D04B93ED54CE7C201108F398E7E159
                                                                                                                                                                                                                                                                                            SHA-256:D549110689CDDE0821CA2C7148F7B47A097166B4169786A4A9EDE675F5CE87F3
                                                                                                                                                                                                                                                                                            SHA-512:D4B4D01088D9F506368DC19D709B4BA6BE764929B0DD05775841E14CBBEC674F216B81515AE529E95ABFD22ED2F3E2D2774363DD4284C8C8B57D203599555F76
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOS2-........?4GSUB*|.@..D<..[.OS/2 .B...,...`cmap^.........d.cvt O._..a....&fpgmb/....b.....gasp......a|....glyf5.........|.head0;.`...4...6hhea.......l...$hmtx..4.......-$loca.........-(maxp.D......... name!.,.........postz.........}.prepldhL..p..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Bold.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 35 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterBold4.000;git-a52131595;RSMS;Inter-BoldInter BoldVe
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):415072
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.167283324857092
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:k9zC2w597PziK+bSvkK3sgUN8HkC48AeIVMhQ/8:e4iK+6I/8
                                                                                                                                                                                                                                                                                            MD5:8F2869A84AD71F156A17BB66611EBE22
                                                                                                                                                                                                                                                                                            SHA1:0325B9B3992FA2FDC9C715730A33135696C68A39
                                                                                                                                                                                                                                                                                            SHA-256:0CB1BC1335372D9E3A0CF6F5311C7CCE87AF90D2A777FDEEC18BE605A2A70BC1
                                                                                                                                                                                                                                                                                            SHA-512:3D4315D591DCF7609C15B3E32BCC234659FCDBE4BE24AEF5DBA4AD248AD42FD9AB082250244F99DC801EC21575B7400AACE50A1E8834D5C33404E76A0CAAC834
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOS\.N.... ..KhGSUB..B..P...]@OS/2 ..........`cmapL......(..d.cvt L.....E0...&fpgmb/....FX....gasp......E(....glyf(.........OXhead0|...bh...6hhea. ....b....$hmtxDt....b...-.loca.0.....|..-.maxp.t.....8... name.D.....X...Vpost}~.......xprepldhL..Td.............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-BoldItalic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 34 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterBold Italic4.000;git-a52131595;RSMS;Inter-BoldItali
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):420068
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.194498558176303
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:xg28OmWqgaGeWLF7k/oONd1P+yyZQl/xFiwRi98:SZG17k/oOX1PXyqCwRi98
                                                                                                                                                                                                                                                                                            MD5:C4C47E3D7ED51A6BB67B7B8088A4B0E3
                                                                                                                                                                                                                                                                                            SHA1:B190F4E4E8F838C46FFE9507D966EA4D8B37D8CE
                                                                                                                                                                                                                                                                                            SHA-256:5E606F805A71432D4875DE7DAB737BF9DEA1187090F0A5190DA9B1BBAB09F57C
                                                                                                                                                                                                                                                                                            SHA-512:B4251618479C52398CA71CFC61AD88230A14145771EF1085AB9288486D7BFC841F0EA222909F8BA6882DB6076DF26BFE37E1C23917569270C86D6E7ADEE7CF13
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOSU..F......IFGSUB*|.@..NP..[.OS/2 ......@...`cmap^.........d.cvt L.....X....&fpgmb/....Y.....gasp......X.....glyf.L.K...0..i.head0....x....6hhea......y....$hmtx...T..y<..-$loca..OH...`..-(maxp.D........ name..........bpostz.........}.prepldhL..g..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBold.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraBoldRegular4.000;git-a52131595;RSMS;Inter-Ext
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):416228
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.155971405270021
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:3VpTx/VCC2wfBsJWPziKSQVE58IqsfnHGR4tGX5/2nHTAl84RSnj3k4yhT18:3Vp+C2wfBDPziK+4suO49lfR98
                                                                                                                                                                                                                                                                                            MD5:5061BD7701B1B3339F0C80E69A2136E4
                                                                                                                                                                                                                                                                                            SHA1:4A028F1FA4DBD6B4BFBFEEC4A5B5E222A005B563
                                                                                                                                                                                                                                                                                            SHA-256:3C13487B8F2EBA0A78CAD4CEFD19272B0F4E53D61C223E6B266DDF0B332E9F1C
                                                                                                                                                                                                                                                                                            SHA-512:65875F9F205CD70D2E1B86FBDA2AC8875637E0B3E0BB37ADE9DA20717B0F17D2108A0CF2AA1B246AFFD73BEA233B510D37D13193801D94E5148D3EC4159653DC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOSB...... ..KzGSUB..B..P...]@OS/2 |.........`cmapL......<..d.cvt NY....I....&fpgmb/....J.....gasp......I.....glyf.B....$..S(head0R...fL...6hhea...X..f....$hmtx:4.7..f...-.loca.>b....`..-.maxp.t......... name(.2X...<....post}.....4...xprepldhL..X..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraBoldItalic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraBoldItalic4.000;git-a52131595;RSMS;Inter-Extr
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):422904
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.1847822896243585
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:EMPffL+f3H4g6WqgDVHqLhDj+359q7z8O8:1khq9Dj+3vrO8
                                                                                                                                                                                                                                                                                            MD5:CDEF819CDB20F81FEB8A2ABDEBE9CDA0
                                                                                                                                                                                                                                                                                            SHA1:EB61A79464DE3932A2D892BF50AD0270BE5791E2
                                                                                                                                                                                                                                                                                            SHA-256:6A2CF89B061033C76C3CD7451113F3D8D29CE2C2E80B273FD60F9474E3927CBC
                                                                                                                                                                                                                                                                                            SHA-512:04DE3B444603887E130870DC9FFF2F6798D737EA77A376C0A6D62C9114709F7891C95FA1BDDAB70FF055EBF127C6584CAECC594659F2E8596E72DA9D62D625E5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOS..\>......I(GSUB*|.@..N0..[.OS/2 }..... ...`cmap^.........d.cvt N:....c....&fpgmb/....d.....gasp......c.....glyf..........t8head0h....H...6hhea...x.......$hmtx.)........-$loca..MD......-(maxp.D......... name+i1.........postz...... ..}.prepldhL..r..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLight.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraLightRegular4.000;git-a52131595;RSMS;Inter-Ex
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):409996
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.169466966393304
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:XmzU22mZrPziKScOkpPSb+sv9wKKpuLpuSZAoM8:yiKcFyKK9SZ7M8
                                                                                                                                                                                                                                                                                            MD5:B7E44012C53F3BCBF154C7C4784FCC14
                                                                                                                                                                                                                                                                                            SHA1:101ABFE1C234D9E29504A55C7B5911F7E20E9425
                                                                                                                                                                                                                                                                                            SHA-256:944F65A7C6CDA135C370559E9D7347BFDD45A579FE4DD1EF8BA5BC679BCD961D
                                                                                                                                                                                                                                                                                            SHA-512:67808D6BDAFE9BCF5576DF234C93611BC827D868DD9F0D064E801DDA5EFE67883637746458B3A0E51B4B394913C3AC47F56C5C055B3FF013ABEBB66EC9A7716F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOS{...... ..<^GSUB..B..A...]@OS/2.$.........`cmapL...... ..d.cvt D.....1\...&fpgmb/....2.....gasp......1T....glyf.I........I.head1....M....6hhea......N ...$hmtx......ND..-.loca.M.x..{...-.maxp.t......... name+.3.........post}F.........xprepldhL..@..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ExtraLightItalic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraLightItalic4.000;git-a52131595;RSMS;Inter-Ext
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):415636
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.1951511440882685
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:327hgoK+yjo8AiWXWqSBCVUWR2kg4yODRVP8UPLumxDaAan+LHvKLMQyaInxFfmo:323K+tiqWqg3FkgdW3xDayLi78
                                                                                                                                                                                                                                                                                            MD5:9E18D79ED628E74CA5E2EE3BFD6446BD
                                                                                                                                                                                                                                                                                            SHA1:BF763C5CC7C91BFEC5E8E42499CA20AEF4C8B942
                                                                                                                                                                                                                                                                                            SHA-256:BB5488DEFD018CF6CEA85B431A40991F0AB8939C39025E835E809160DCD912A6
                                                                                                                                                                                                                                                                                            SHA-512:35A128E169D7CBC551C0337D78996E2061F8165E1B61870634A1EE6715199507F5FA140177C8A821401EAA765FC16FCC73E0180A21004803F6FC69EF512737F3
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOS>.uG......:.GSUB*|.@..?...[.OS/2.%.........`cmap^......D..d.cvt D.....Gd...&fpgmb/....H.....gasp......G\....glyf*#:]......f.head1....f....6hhea.w....g....$hmtxe2.{..g4..-$loca...d...X..-(maxp.D......... name-.3z........postz[.<.....}.prepldhL..V..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Italic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 34 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterItalic4.000;git-a52131595;RSMS;Inter-ItalicInter It
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):412848
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.2017904291058406
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:C2vSKsOi+1iqWqgfYs0S2S7vWAlcBJPH8:1PqIS2S7v3lcB98
                                                                                                                                                                                                                                                                                            MD5:118ABBE34A2979B66D6838805C56B7CD
                                                                                                                                                                                                                                                                                            SHA1:7F320CB81660FC6DFF9CC5751F8FCC0134847C77
                                                                                                                                                                                                                                                                                            SHA-256:D054D998AE12BE33820B100E0ED3923D513FA5C79C6D4E7CA1953AFEB262EA9B
                                                                                                                                                                                                                                                                                            SHA-512:5BCAD4A03CED2CE76C5EBF78CD2C1328A4EE27019807F56A48BF8A0F936C57F351F10726C176952F0CF08776A5CE53D34C14D6A848925BE2789408A61678F381
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOS.}.......7.GSUB*|.@..<...[.OS/2.........`cmap^.........d.cvt H.6..<....&fpgmb/....=.....gasp......<x....glyf........._Lhead0..i..\....6hhea.?....]....$hmtxF)...],..-$loca.k6....P..-(maxp.D.....x... name...........>postzz.{......}.prepldhL..K..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Light.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter LightRegular4.000;git-a52131595;RSMS;Inter-LightIn
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):408364
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.1740190502785195
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:oeroPfXwF22mZ8JWPziKSQYfW0LXYveHt+47O3YqF5nxeU2h8jjXVymj3k4yhb18:ovw22mZzPziKYW0jYves4I2n8
                                                                                                                                                                                                                                                                                            MD5:FF5FDC6F42C720A3EBD7B60F6D605888
                                                                                                                                                                                                                                                                                            SHA1:460C18DDF24846E3D8792D440FD9A750503AEF1B
                                                                                                                                                                                                                                                                                            SHA-256:1936D24CB0F4CE7006E08C6EF4243D2E42A7B45F2249F8FE54D92F76A317DFD1
                                                                                                                                                                                                                                                                                            SHA-512:D3D333B1627D597C83A321A3DACA38DF63EA0F7CAB716006935905B8170379EC2AAB26CB7FFC7B539CA272CF7FB7937198AEE6DB3411077BEDF3D2B920D078A3
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOS,F.P... ..=<GSUB..B..B\..]@OS/2...2.......`cmapL.........d.cvt F..,..*....&fpgmb/....,$....gasp......*.....glyf:;........B.head0....G....6hhea......G....$hmtx..Zi..H ..-.loca.&9...u...-.maxp.t......... name..-.........post}U.7...|...xprepldhL..:0.............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-LightItalic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter LightItalic4.000;git-a52131595;RSMS;Inter-LightIta
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):415024
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.199271793956543
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:BgWQyjI8Ai+XWqSBxVUW+EuzZKKH+XgoniJ2D5L2kZSVbnN90oGPP3+4yCT18:BgWQtiiWqgsR3n+XgZJ2xqu58
                                                                                                                                                                                                                                                                                            MD5:4B1FFAD3C0075AF22674765FF1EE2F56
                                                                                                                                                                                                                                                                                            SHA1:1F7B05D0ED1C6C15736115A59AD844ADEA5F1F66
                                                                                                                                                                                                                                                                                            SHA-256:FE3714926082AC5764327E3B67AE52CB6F0CF6B8C4221C064A6CACF821079414
                                                                                                                                                                                                                                                                                            SHA-512:427DB3FE5860676FAB65A9B895D205620A1EC0AA172F45AA9ECEF261820E25B84F3413BC5D0A9D0C1311422A8DA1F5706AC4F6211A60AACC82974CF00FF036A4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOS...C......;\GSUB*|.@..@d..[.OS/2...S...T...`cmap^.........d.cvt F..$..E....&fpgmb/....F(....gasp......D.....glyf..t....D..clhead1 ...d....6hhea.i....d....$hmtxU.b...e...-$loca.......0..-(maxp.D.....X... name!A-....x....postzj.\...X..}.prepldhL..T4.............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Medium.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter MediumRegular4.000;git-a52131595;RSMS;Inter-Medium
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):411500
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.179950752404769
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:D0RV3jlWkDOh9oC2wuhsJWPziKSQlRiFy34YmkCD9oI0+msvMlwt5BO2x28YzWDQ:D9SxC2wuhDPziK2yIYmkCCIPmsHI8F8
                                                                                                                                                                                                                                                                                            MD5:A473E623AF12065B4B9CB8DB4068FB9C
                                                                                                                                                                                                                                                                                            SHA1:126D31D9FBB0D742763C266A1C2ACE71B106E34A
                                                                                                                                                                                                                                                                                            SHA-256:1BDA81124D6AE26ED16A7201E2BD93766AF5A3B14FAF79EEA14D191EBBD41146
                                                                                                                                                                                                                                                                                            SHA-512:1FBC2841783140FE54F3AB1FA84E1DED2534BCEC3549ADE2F513491B32178DF515BD63A0A4A2C35017A6850FF9C3A24F8602357D912ACF8CA92B8D68BA846D3A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOS@@..... ..J.GSUB..B..O...]@OS/2.P.........`cmapL......d..d.cvt J"....7<...&fpgmb/....8d....gasp......74....glyf......L..A.head0....S....6hhea.c....T0...$hmtx......TT..-.loca..........-.maxp.t......... name ./.........post}m.g.......xprepldhL..Fp.............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-MediumItalic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter MediumItalic4.000;git-a52131595;RSMS;Inter-MediumI
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):417780
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.206431815755074
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:/DRFemw/pjVeXWqSBpVUW8KOA8HiQ109P0GJrMfsVwGSkSdnMgVIwZp3+4yCr18:/DKmChCWqgkJKy6zMfsdUDv8
                                                                                                                                                                                                                                                                                            MD5:9A21378C7E8B26BC0C894402BFD5108C
                                                                                                                                                                                                                                                                                            SHA1:72BD9F3CA75CA691CE86FE1EBBDB269F5F737BAE
                                                                                                                                                                                                                                                                                            SHA-256:0D34F9588400A586B774BE97E66AE8C076A8807B8455DF0587B39D2A4A1A3B42
                                                                                                                                                                                                                                                                                            SHA-512:4A9D23A01F1A7474E0339D4D8B151D0269BFAF7D9E13FF6AA34D7F929002E8FF185F273E6F7AFD2D40DF3E0630A962DC7767D870DCF1766F3E04B8029A7B452E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOSNc........H2GSUB*|.@..M<..[.OS/2.Q.....,...`cmap^.........d.cvt J..}..O....&fpgmb/....P.....gasp......O.....glyf...Y......aLhead0....oh...6hhea......o....$hmtx......o...-$loca.l........-(maxp.D......... name#..y...0....postz.........}.prepldhL..^..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Regular.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 35 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterRegular4.000;git-a52131595;RSMS;Inter-RegularInter
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):407056
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.1736927573676335
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:sSnv4lXwF22mZ8JWPziKSQUmeKGVOOxAdgwH9evDFDynor51EOO2UAGbzxSr1w7b:sSvJ22mZzPziKwLOOkvH9IQoUf7P08
                                                                                                                                                                                                                                                                                            MD5:FDB50E0D48CDCF775FA1AC0DC3C33BD4
                                                                                                                                                                                                                                                                                            SHA1:5C95E5D66572AECA303512BA41A8DDE0CEA92C80
                                                                                                                                                                                                                                                                                            SHA-256:64F8BE6E55C37E32EF03DA99714BF3AA58B8F2099BFE4F759A7578E3B8291123
                                                                                                                                                                                                                                                                                            SHA-512:20CE8100C96058D4E64A12D0817B7CE638CEC9F5D03651320EB6B9C3F47EE289CCC695BD3B5B6BF8E0867CDAB0EBB6E8CAE77DF054E185828A6A13F3733EDE53
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOS,ta.... ..9.GSUB..B..>...]@OS/2..g.......`cmapL......p..d.cvt H.H..%....&fpgmb/....'.....gasp......%.....glyf..L...X..A.head0..j..C....6hhea...]..C8...$hmtx......C\..-.loca...X..q...-.maxp.t......... name...V.......npost}e.V...`...xprepldhL..5..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBold.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter SemiBoldRegular4.000;git-a52131595;RSMS;Inter-Semi
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):413976
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.169175161562876
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:SMPc0C2wQtzPziKFfAi2bNru42U5CB1c8:5hiK9AiENr/2UYc8
                                                                                                                                                                                                                                                                                            MD5:4D24F378E7F8656A5BCCB128265A6C3D
                                                                                                                                                                                                                                                                                            SHA1:D48310D2F04C57AF1BCE0851E053BE7B58B25DCA
                                                                                                                                                                                                                                                                                            SHA-256:0DC98E8AA59585394880F25AB89E6D915AD5134522E961B046CA51FAD3A18255
                                                                                                                                                                                                                                                                                            SHA-512:38B18D9786046633E4992308C88F11CA5CED325F805EB29B3000533459E85DFB6CD87655F1E285AF8DA22AC04722AB354DBDA24667297B56CCA824EF227373F1
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOSd]..... ..KPGSUB..B..Pp..]@OS/2...........`cmapL.........d.cvt Kt....@....&fpgmb/....B.....gasp......@.....glyf.8........J.head0....]....6hhea.A.h..]....$hmtx{xJ...]...-.loca.!R.......-.maxp.t.....\... name%.1....|....post}v.w...h...xprepldhL..P..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-SemiBoldItalic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter SemiBoldItalic4.000;git-a52131595;RSMS;Inter-SemiB
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):418520
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.2010032658690255
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:0UW00H2WqgwJA65hgQ0Yp9nyu8qIzoGS9U8:FWwJAuGQ0Yp9n5szrIU8
                                                                                                                                                                                                                                                                                            MD5:04551623D1023398FD3DA941E920D727
                                                                                                                                                                                                                                                                                            SHA1:92789CCC0D76C04D86685F9F0529731D2DC38852
                                                                                                                                                                                                                                                                                            SHA-256:1E1289453D7A895CFB73569D4851634C8B0E49D150C4DD52D44BF5D206908272
                                                                                                                                                                                                                                                                                            SHA-512:8017346110AEE84614FC0D9A9B39505F042E23659BE367C8A84301DC6E41C3DD93A464E88DCDF06F10B3B3AC85E975BC69EB464ED4CD784309564836289D412C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOS..j......I:GSUB*|.@..ND..[.OS/2.......4...`cmap^.........d.cvt K_....R....&fpgmb/....S.....gasp......R.....glyf.......$..c.head0....r4...6hhea......rl...$hmtx..Q...r...-$loca.n........-(maxp.D......... name(u0.........postz.........}.prepldhL..a..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-Thin.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ThinRegular4.000;git-a52131595;RSMS;Inter-ThinInte
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):403404
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.15775244572357
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:FZbewyXwv22mZ8JWPziKSQQQbdiJNnL1qIPQyC4JRPeQQFgppInr/qwAWJBIF072:FZCU22mZzPziKPd6PQgcgpa/nMF07J8
                                                                                                                                                                                                                                                                                            MD5:B97F16379B4C106616F60F702733F5C6
                                                                                                                                                                                                                                                                                            SHA1:85C472FB9A7F256643BC4BBA10F158DFAA1D1E8B
                                                                                                                                                                                                                                                                                            SHA-256:4C392DCC8AD916F0F9DF7559AB5563B01DD94F9F3B2DB34617FE392E00060339
                                                                                                                                                                                                                                                                                            SHA-512:D124AF2C705B97CBB307497F88C47A5F7D320174D48626EA14AC27D42BCF8016F32810CF7ECB6AF1261297B8C331A6EA89E2E35C3E2536390D8D6E500ED8D61E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEF.m.v........GPOS...... ..6.GSUB..B..;...]@OS/2..........`cmapL......L..d.cvt B..........&fpgmb/..........gasp............glyf5?.$...4..6<head1..i..4p...6hhea...-..4....$hmtx..6Y..4...-.loca......b...-.maxp.t.....@... name..,z...`....post}6.........xprepldhL..&..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Inter-ThinItalic.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ThinItalic4.000;git-a52131595;RSMS;Inter-ThinItali
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):410232
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.191384356621797
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:nm0XOI8wiWXWqSBNVUWI9Wd4EZDSwKBUMimozkhBiv98svLAYP0wJShe3+4yCL18:nm1GiqWqgwbMd4EZDDpmokGllkYMdQ8
                                                                                                                                                                                                                                                                                            MD5:12EC66B825B504D752E8C333BF81DACF
                                                                                                                                                                                                                                                                                            SHA1:56896D3E6011466B7E6631C714C57E20EE8366D9
                                                                                                                                                                                                                                                                                            SHA-256:5FC09AF94A447FAE6F82C00F15DFAEF9EAE7C560E6CBE46D3E84524019A574AA
                                                                                                                                                                                                                                                                                            SHA-512:8CB838589AC4F9819B7E2204517445DF94663D3217297212973E8B2D9FECE162155130DDC783E7E89EF2832D38BACE731B2AE3B73AFF36AD782C707813BC52B4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............GDEFj.`i........GPOS.n.t......6RGSUB*|.@..;\..[.OS/2.......L...`cmap^.........d.cvt B.....2H...&fpgmb/....3p....gasp......2@....glyf.,....<..U.head1<.h..R....6hhea..._..R<...$hmtxt.<...R`..-$loca.?w.......-(maxp.D......... name..+.........postzK........}.prepldhL..A|.............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\fonts\Underwave-Bold.ttf

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:TrueType Font data, digitally signed, 18 tables, 1st "DSIG", 13 names, Macintosh, type 1 string, UNDERWAVERegularUNDERWAVE1.500;Glyphs 3.1.2 (3151)UNDERWAVE
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):745320
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.213167401688859
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:3riWrg8ws8rpPgBZiq2GuzoyG2JfffffQPfnVd:3rLfgWiq2Gu0yG5fnb
                                                                                                                                                                                                                                                                                            MD5:A0A0C6917910F0D4C1A8EC4562285468
                                                                                                                                                                                                                                                                                            SHA1:D09EE8BB53B6DDC718F71E13109540F659B9444B
                                                                                                                                                                                                                                                                                            SHA-256:41079C47E940F7A84A79FC55D0FACA4651312F8E9FB8D85E9FA1A0B1BF989A3E
                                                                                                                                                                                                                                                                                            SHA-512:3A06F4E8B33613D665540980491CB0069B4DB5B9B91B7C3D041307A2335701B29AC29EEA7D1DC4FACAA6D72E6EAC6D5B36F555A0CB5E068BE5C90205997CE04C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........... DSIG......_`....GDEF.>.2..8....pGPOS..I..8t....GSUB.e...C|....OS/2..^........`cmap...........cvt ...^...L...Pfpgm..w....P...Ygasp......7.....glyfB..........dhead:.0...,...6hhea..SW...d...$hmtx.'Q.........loca!_..........maxpE.......... name{\.(.......1postGQ.>.......<preps..B.................d"_.<.................#k....:...........................d...>..................C.....C................$.....................3.......3......................................UNKN.........................^..... ...$...............................................................................................................................................h.8...`.r.H..._.................T.....x...h.P...@.....q.|.g...q...q.".W...u...u...u.Z.k...u.........K...J...K...I.....H...h...h...j...i.x.g...h...j...j...k...k...j...k...i...j...j...j...j./.h...j...j...j...7.,.....T.:.B...j.......9.....b.m...........g...h...h...h...k.....).i. .e...........k.f.....i...j...i...i...i.p.i...h.\.:...i...B

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\partner_speeddials.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (347)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1765066
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.359819866011935
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3072:gAq9FBMUHApAeA6+Am9AsAFAOGbAY5sqAV7kBhAGU+ADsAvAZAW+AZxXAkiUbAbE:mZ1pMdpw85EzW68NAd
                                                                                                                                                                                                                                                                                            MD5:AC787BB3877E5E15A0DA8606A2C7BC9A
                                                                                                                                                                                                                                                                                            SHA1:AE299077932BA22193CC82AC3E1844D9BE12D8CE
                                                                                                                                                                                                                                                                                            SHA-256:16A07A3FB2E173E01BE98E30F3ED396E1FE1D6B06B0EE91152D5553940F0F075
                                                                                                                                                                                                                                                                                            SHA-512:82F9670AF1BC70E6EE56FDA0B0319567230EF211E448CCBB000092531A9A6C57A3D3EEA63AE58809AC55CBA4224E7284426E3FF7178B925A7B70E410BDD6ACC7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// XeyhvOA9db/PbkGubELMGyCAYkiN8al4GeNh2DlrJWnTj/k9SOzGvQfWOtxwfKYUXHIW01e20gCvfPWZzeraJm663Wq1L91DY2RPNmXOiGqswun3YS4VVDZIgE9LVhYpL7Qb8tHKxGJc0i9/wgVuuxAHXWUtXzLmT1VHTesioRl3HLvdYC1+hTLiY87XU0GgtR4qEbPGqV/aA6CzrzLLjPvh8w9dsr+3x/JM3VkEV1ooj+P2vqyemIECI78kPICdzEYn8+j9GWqWFXMxS3dgqF1cOmKh/+N3zD8KviZow4nlcyxqkykSvKDbXbQjHcSppIwNfuF8qB8ORPviAZPqyQ==.{. "*": {. "speeddials": [. {. "favicon_url": "https://sd-images.operacdn.com/api/v1/images/46b911f451044a30c1aa38f062e1a4939605f09b.png",. "name": "Twitch",. "partner_id": "kFAcNbAe4iy5E560CUCIhN+05nr5nudSkqsVoer1/tM=",. "ping_url": "https://speeddials.opera.com/api/v1/clicks/a0ZBY05iQWU0aXk1RTU2MENVQ0loTiswNW5yNW51ZFNrcXNWb2VyMS90TT0=",. "position": 1,. "real_url": "https://www.twitch.tv/",. "replaceable": false,. "revision": "20190409",. "thumbnail_url": "https://sd-images.operacdn.com/api/v1/images/20586137116208fbaa36984a3165942edf7daea0.png",. "url": "https://w

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\purchases-schemas.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):134754
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.912152746351969
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:384:HheiiOv/GKbJ0Srmhmvm4mxsmWy9IrjRR2UmIm8pNI170TZM2TRfdL82Bcj5d+SA:7cUw46YQbjD6YbW0LGEcE6x
                                                                                                                                                                                                                                                                                            MD5:50B7EEA5800999F39B8C3D93AEBA6545
                                                                                                                                                                                                                                                                                            SHA1:781B66FE6B6548CF39522E3661BD6A9ADE39456F
                                                                                                                                                                                                                                                                                            SHA-256:239158E719514AC1205D1844643E24440D0833C0C7C64060AAFB6FE2378C63D4
                                                                                                                                                                                                                                                                                            SHA-512:192CEA97EAE5C5148D4D5C1AC818CCB9C75F12119446BD772A9BDFC07975739A66558B580BA5B29FF47275B60DE099C954E82B91CC34DB683C63ECB42C671052
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// nT/e0fNNq9R2n1GNHggMQYT4GDR4XJHAsGYhnPcLb+eG0AT87u+hknCDu03zU4w1JTGc7yrHkkK17b8TIT5tk9x9KU8mgfFBqUYb39RlMQg/CzgtdoRj6qzpRGbApfZCt6JpUvp+64u5NUh1lWMayZmuKg+teFql4t1J77VVkoU5OgZxe5PGy4Hz6S+MzoiqHndxSpFPSEuIdFjOEhczMm6YPhqvMqg8IIoNGkqMcqVRM+gE/hIHPcmtvq/I8ddyvmKdB24FrzZDbUOCA704/zJrA90VqpJZYXjdYqYEH4Waa3TqqxD5HB5OJ/ps6pJS83kIVpH5qRL0pZbCnhl26Q==.[. {. "partnerKey": "etsy.com",. "onfetch": "set-basket",. "urlMask": "^https:\\/\\/www\\.etsy\\.com\\/[a-z]{1,4}\\/cart\\/[0-9]+\\/review.*",. "recordSchema": {. "partner": [. {. "type": "value",. "value": "etsy.com". }. ],. "locationUrl": [. {. "type": "eval",. "value": "location.href". }. ],. "cartTotalValue": [. {. "type": "querySelector",. "value": ".order-total-cost .currency-value",. "property": "textContent",. "postprocess": "pricevalue". }. ],. "cartTotalValueCurrency": [.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\siteprefs.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):17998
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.102625475354728
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:192:Elt9h75KiPx9FEfFOvV/woaVvAg33wkPvvEyh8f2YfIMteve:ED75LZEdm/F6v733LBh8f2Fm
                                                                                                                                                                                                                                                                                            MD5:3C1D65433B74A8B2C0C204CE4F206B0E
                                                                                                                                                                                                                                                                                            SHA1:FE2DFE6030A0F18495CFFF344274CDD02728CD9A
                                                                                                                                                                                                                                                                                            SHA-256:5D5859106FC8167043F3E6524119307261BA0ACA60B8A5F4CA664F6E83F9D9DA
                                                                                                                                                                                                                                                                                            SHA-512:7AB34815A52F178F0832AB764F0701B0139A848D2B897EEA03CDDE65CC03B5907D4473FC9D20024AD1411F7D783E5D449B5EE020FD2C294C074AD5072181D5E2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// HunM9OQI1UAzLc+/REbdxwYPlSjzkaxOROy+Kl35uGCt7donuOkEcqxsRfskQaQ5W+uifDT1T9sOPd8AbL91AGbbDFfn1zfTfN78RrC7G3tKHcamG6faSu6NjxabEl+7DGCav7c3vLZk4ZycUN/9uKk30cNAM1UvMy0GasGORX2W3uumkkYymwLurk+2GQq4aGmAMHcAjzm+gVoJSOA0Mz+T2hAhRQ2I0MYVi3p8rGs0ZqjKluqwXZCRdkVH8fr6ncX+FBH/K0Paxiie+RBWCa/JVIXRP0MfLxMs0iskDzf70VGz5e7jcJUJR+mad6YNEsI8+3ZRHHOVf3+SbmewKQ==.{. "@version": "2.0",. "timestamp": "202407041455",. "firefox_ua": [. "youtubekids.com",. "techtitute.com". ],. "chrome_ua": [. "pansa.pl",. "get.activedisclosure.com",. "atletico.com.br",. "finalfantasyxiv.com",. "votefae.diplomatie.gouv.fr",. "mathworks.com",. "onlineservices.ubs.com",. "ebanking.brou.com.uy",. "roll20.net",. "home.netatmo.com",. "crunchyroll.com",. "adobe.com",. "nenlahapcbofgnanklpelkaejcehkggg",. "jgcdgnmchkahmkfgmdgceagjlepkpadk",. "lime-technologies.com",. "lime-crm.com",. "s

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\specific_keywords.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (5243)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):46132
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.476429533205484
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:768:kEzP3QpnVouOS/8pn4pNiO6btzP3QpnVjuOM/zpn4YNiOvv:kEzP3QpnDOS/8pn4pNROzP3QpnAOM/zn
                                                                                                                                                                                                                                                                                            MD5:34CEDACC1C62313116216EA57A16683A
                                                                                                                                                                                                                                                                                            SHA1:D627058E97DCAD8F0A8737DFE2FFA195D868E5E7
                                                                                                                                                                                                                                                                                            SHA-256:F04CD2A8EC2686420E9A89C454C379C76B610BE2AD62E2F2F1A9641A9D9ED286
                                                                                                                                                                                                                                                                                            SHA-512:FA9947AEFFBB687B4D0D632323BAD68E5E93572398FBDD5A7665E1530F3327BFA4307C4AC8AC035E423A667C322FBBF98CCA4995AB9B8EFEBBED99761D753D18
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// DJk2k3pkp9cay3NljwD03+GA6BPihyqZAPyGTt49ivHi9iZ6PCltyC1kZ47WPQmo7WuEhxdSZaZN7uE+VJdTrnfzgcTe4Nz9SU60AUeW3rV7dLOmyQuCm6HExT8VxWHux47vXFsehnQYT8kx56qh1FwN96iY0bsNMLnuo4JA2Hdobl43moGSrTi/eIGdTpA6pq1oHaQgMA8tu6ztgOuMXrE85Qkl8WGanStebuBLdRfGlBkLVG8IqS2YqFyTS5E7NjDLkqOYjx/rM00TqYbFaiVdCkUl5Iu/HyF3eE0cF2dpFLScIb29KBifsTSuiJpxQNvJrGe51SoLHg5oZFQFpw==.{. "version": 1,. "should_reset_discarded_ids": false,. "de":. {. "keyword_groups": [. {. "ids": [. "booking",. "expedia_hotels",. "tripadvisor",. "hotels_com",. "tui". ],. "keywords": [. "achensee",. ".gypten",. "albuquerque",. "alf",. "allg.u",. "amalfik.ste",. "andalusien",. "antalya",. "antwerpen",. "argentinien",. "australien",. "azoren",. "bad kreuzn

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\resources\video_conference_popout.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1064
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.216969853800906
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:AZMCz9sRJH4/jRGRiv9dmH4/K2wFghIsv9Z7d/jJNHAA9Zn+DYd/jJNHAA99lH4O:AZMSTrd3K2SgIslZ7d5Z+Ud50+D
                                                                                                                                                                                                                                                                                            MD5:19BEF2D091C16C4EE3F7B9D63A48EEC2
                                                                                                                                                                                                                                                                                            SHA1:E148797C1874D3DF0F9AADA3C217BAD86E07B49B
                                                                                                                                                                                                                                                                                            SHA-256:A31AEB78E781F22CEE4220D24B8D62AE139902E37804BC836EADD90264AEDBB9
                                                                                                                                                                                                                                                                                            SHA-512:A245BB9E697897239B449BBB35197E8033285BB7C9F101CFD8AE43FB434149102F28534C2C58D561341B72DDE90632FDAF5D73E5DECE5D453C221D67987302D0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{."version": 7,."list": [. {. "urlMask": "https://meet.google.com/.*",. "width": 700,. "height": 450,. "blocked": [. "https://meet.google.com/",. "https://meet.google.com/about.*". ]. },. {. "urlMask": "https://whereby.com/.*",. "width": 700,. "height": 450,. "blocked": [. "https://whereby.com/",. "https://whereby.com/blog.*",. "https://whereby.com/information.*",. "https://whereby.com/sitemap.*",. "https://whereby.com/user.*". ]. },. {. "urlMask": "https://teams.live.com/_#/pre-join-calling/",. "width": 700,. "height": 450. },. {. "urlMask": "https://teams.microsoft.com/_#/pre-join-calling/",. "width": 700,. "height": 450. },. {. "urlMask": "https://meet.jit.si/.*",. "width": 700,. "height": 450,. "blocked": [. "https://meet.jit.si/",

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\root_files_list

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):730
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.668284777150785
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:mgWiqgWiGlctgWmXagWmQEtgWqDWgWqbtgWSgWuWHwWiqwWiGlcHwWmXawWmQEHu:mgWiqgWibtgW2agWZEtgWqDWgWqbtgWJ
                                                                                                                                                                                                                                                                                            MD5:3B491170F7EEA56B574A24876BF7451D
                                                                                                                                                                                                                                                                                            SHA1:C5CC1BE375BB413978752F0210CD0A76A415FAEB
                                                                                                                                                                                                                                                                                            SHA-256:D30B4A5E4B31A93F5EB6C20D94243839DFED71E69071683C6838B424CC2A071D
                                                                                                                                                                                                                                                                                            SHA-512:178AF7B1AD0A2ADC377B921C350BF877E4D82E561C2058B7DA66CBD6172681849E4ECA77DD2D385AB8309179B15C52B2522F181A5188A448478A09677F68C7AB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:Assets\150x150Logo.scale-100.png..Assets\150x150Logo.scale-100_contrast-white.png..Assets\150x150Logo.scale-140.png..Assets\150x150Logo.scale-140_contrast-white.png..Assets\150x150Logo.scale-180.png..Assets\150x150Logo.scale-180_contrast-white.png..Assets\150x150Logo.scale-80.png..Assets\150x150Logo.scale-80_contrast-white.png..Assets\70x70Logo.scale-100.png..Assets\70x70Logo.scale-100_contrast-white.png..Assets\70x70Logo.scale-140.png..Assets\70x70Logo.scale-140_contrast-white.png..Assets\70x70Logo.scale-180.png..Assets\70x70Logo.scale-180_contrast-white.png..Assets\70x70Logo.scale-80.png..Assets\70x70Logo.scale-80_contrast-white.png..Resources.pri..launcher.visualelementsmanifest.xml..opera.visualelementsmanifest.xml..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\root_files_list.1730212712.old (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):730
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.668284777150785
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12:mgWiqgWiGlctgWmXagWmQEtgWqDWgWqbtgWSgWuWHwWiqwWiGlcHwWmXawWmQEHu:mgWiqgWibtgW2agWZEtgWqDWgWqbtgWJ
                                                                                                                                                                                                                                                                                            MD5:3B491170F7EEA56B574A24876BF7451D
                                                                                                                                                                                                                                                                                            SHA1:C5CC1BE375BB413978752F0210CD0A76A415FAEB
                                                                                                                                                                                                                                                                                            SHA-256:D30B4A5E4B31A93F5EB6C20D94243839DFED71E69071683C6838B424CC2A071D
                                                                                                                                                                                                                                                                                            SHA-512:178AF7B1AD0A2ADC377B921C350BF877E4D82E561C2058B7DA66CBD6172681849E4ECA77DD2D385AB8309179B15C52B2522F181A5188A448478A09677F68C7AB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:Assets\150x150Logo.scale-100.png..Assets\150x150Logo.scale-100_contrast-white.png..Assets\150x150Logo.scale-140.png..Assets\150x150Logo.scale-140_contrast-white.png..Assets\150x150Logo.scale-180.png..Assets\150x150Logo.scale-180_contrast-white.png..Assets\150x150Logo.scale-80.png..Assets\150x150Logo.scale-80_contrast-white.png..Assets\70x70Logo.scale-100.png..Assets\70x70Logo.scale-100_contrast-white.png..Assets\70x70Logo.scale-140.png..Assets\70x70Logo.scale-140_contrast-white.png..Assets\70x70Logo.scale-180.png..Assets\70x70Logo.scale-180_contrast-white.png..Assets\70x70Logo.scale-80.png..Assets\70x70Logo.scale-80_contrast-white.png..Resources.pri..launcher.visualelementsmanifest.xml..opera.visualelementsmanifest.xml..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\snapshot_blob.bin

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):313526
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.171315627339688
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3072:TgC8/wQXLwqHMp2ubdJbhx73by4z2mihppIlYihJtkoBzpwDTA:TgC8XwqexrNu5Cujs
                                                                                                                                                                                                                                                                                            MD5:5485B18F7D15132F02D82D718D0067BE
                                                                                                                                                                                                                                                                                            SHA1:AC5FED6ECFC262A4E321DF74E2E54CC2C0EDF002
                                                                                                                                                                                                                                                                                            SHA-256:05A7D190758E1B9508C19CEB9EEFDDF346852F6A1080E36509360DD57E0ACD34
                                                                                                                                                                                                                                                                                            SHA-512:50DB8E15E58ACF0C57D5818838BDCD1F3DE205B0F12DBF39EBA74B90B683FE21AAAC4F1DDDA0C5BBD727D6DD0DD5E29C4D6E0EF926429B203866AC205153CF3A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........1.\...12.8.374.36......................................................K..&...........<...`K....a........a........a2.......aj.......a2.......aN...............r.........2..............R..............r.........2........(Jb....Q.....@..F^.E..I.`.....(Jb...2U.....@..F^..`.....H...IDa........Db............D`.....A.D`.....D]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\v8_context_snapshot.bin

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):665981
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.170969053897484
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:3BUhye6gCsgwqexrNu5kTGWDgH1Q1dhgXcUhxRd/4RpZqCaByg6EkknFmJA:3BUhye6gCorGWD9qMgNCaBYEznFmJA
                                                                                                                                                                                                                                                                                            MD5:42D8A0B0EF6A264FF266C214F75487CF
                                                                                                                                                                                                                                                                                            SHA1:336DE8F688DB9AAC5429A43196734822380BC625
                                                                                                                                                                                                                                                                                            SHA-256:92177F36B6FD7F1D0BB9E8B90ADEAF88D5F550F7B3E3249045E5DA5BECB75111
                                                                                                                                                                                                                                                                                            SHA-512:56A29BD8CEBA95030205A39415B4DB33CE8A30687AD20E778C3A1DD5C5879CBD15DD021AB46DB0026E8EEEF6B43442BCF55B0D5822A5012EB123F0C3CACD29A1
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........h...na12.8.374.36.....................................................P....e.......P..........<........a........a........a........aj.......a2.......aN...............r.........2..............R..............r.........2........(Jb....Q.....@..F^.E..I.`.....(Jb...2U.....@..F^..`.....H...IDa........Db............D`.....A.D`.....D]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vk_swiftshader.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5292440
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.316007381972135
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:DWgSq5hnDsmnWxVJ4pv5U74j/gtEnW5rgqUi+irYl+3znKHOvb8PajRaYhyjdrXp:XthnD/k8OvbcasFEhO
                                                                                                                                                                                                                                                                                            MD5:BE428F126AAEFEA8C775F7880CB38CA5
                                                                                                                                                                                                                                                                                            SHA1:FADDF946C0A63C26DA019E53F40623BB98B2995D
                                                                                                                                                                                                                                                                                            SHA-256:78B0C836A0E6059C94B245A87610831070F8C0D08B2EF2B99F277C17250EADA8
                                                                                                                                                                                                                                                                                            SHA-512:2CC5272E17EBF3E285E009AE8BA680E5AD33E979F297C7A7C817B893CEA40270ECA777B0D4FE812CA4AB289A94EC83CD970FB51E69870BCCF8BB9225DEE5EEDF
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ......?..........W7...................................... R.....v.Q...`A........................................hYL.....@yL.P.....Q.......P.4(....P..)....Q.pj..\4L.8...................@3L.(.....?.@............}L.8............................text...W.?.......?................. ..`.rdata..tq....?..r....?.............@..@.data...H....PM......0M.............@....pdata..4(....P..*....N.............@..@.gxfg....-...@Q.......O.............@..@.retplne.....pQ...... P..................tls....Y.....Q......"P.............@..._RDATA........Q......$P.............@..@.rsrc.........Q......&P.............@..@.reloc..pj....Q..l...,P.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vk_swiftshader_icd.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):106
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                                                                                                            MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                                                            SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                                                            SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                                                            SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\vulkan-1.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):895896
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.631194583130802
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24576:tBworv9ysd/p1K3zPu6Z5W1DYsHq6g3P0zAk7l0NNFv:tBXlL/zCzW6Z5W1DYsHq6g3P0zAk7yV
                                                                                                                                                                                                                                                                                            MD5:7312E14A611BC7346F9AC9F0786BADC7
                                                                                                                                                                                                                                                                                            SHA1:769411E19CE6EB4043180A23523C684ED68AE516
                                                                                                                                                                                                                                                                                            SHA-256:DB3EC06B816EE71ED6871B0DFD750EDC8D6F74ADEA081149AC453B3E417C25EB
                                                                                                                                                                                                                                                                                            SHA-512:79BDB17FCC7A067D2ADE9AD39C3C312A3A58157C98DE17DF3E9947D71A1DBC7B6FCE9C1B7E3759CCC7DFF6184976A2F9D6F08E58ED3C2190A61849B41FC48626
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .................{...............................................0....`A.........................................(..<!...J..P............ ...b.......)......$.......8.......................(.......@...........8N...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata...b... ...d..................@..@.gxfg....'.......(...B..............@..@.retplne.............j...................tls.................l..............@..._RDATA...............n..............@..@.rsrc................p..............@..@.reloc..$............t..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\win10_share_handler.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):994200
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.4361786085506605
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:12288:h/Pedhd4TpI5BdUDUoLqEK23sB5pgu4n/WMquQZtbdQnXkwkoa:YdT4TpgdZoLqHBbH5lZA5kB
                                                                                                                                                                                                                                                                                            MD5:43D62A816E143303EB44C39742D21B7C
                                                                                                                                                                                                                                                                                            SHA1:B55E623A3EC52536F454C96C8A675DA02DEEAEAA
                                                                                                                                                                                                                                                                                            SHA-256:B70D5C8AFC4BD56858F1A1B2D7F25C1123DB696EE4A2E12356D2E5CA6788DF29
                                                                                                                                                                                                                                                                                            SHA-512:37C0E214F100354DF4AC12B4ED20406154C566FC0C40D7C5C0F9C8378470B8D1BCD26921C085D145BEBB9DC48B1039F18685F9BB7FAD22D91F02549B870ED58C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." ................@.....................................................`A................................................,...x................d.......)..........<...8................... ...(....!..@............................................text............................... ..`.rdata..4v.......x..................@..@.data...H}...........n..............@....pdata...d.......f...V..............@..@.gxfg...@'.......(..................@..@.retplne.................................tls....j...........................@..._RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\win8_importing.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):570264
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.1877555450855235
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:6144:Z8CEsuMAnuKbFjTX2M7JwESuFnWYTlZRD+RQz70wvmI2/JCf3Ui+C82:WGuMTMdtSuF7vz70wvmb/JC/UjU
                                                                                                                                                                                                                                                                                            MD5:AF614C3AE4318BA2E418BE2E0181CFB4
                                                                                                                                                                                                                                                                                            SHA1:7A9DECDE6D7950225B4D9DCD5AE7C59EB937AD17
                                                                                                                                                                                                                                                                                            SHA-256:84C8FF008586A5B65E3905B95B557324F2C5403565383F97087A608C55AE7DEA
                                                                                                                                                                                                                                                                                            SHA-512:E6A0A6C76B6F0A7A0E9AF617FF0BB0B94F637A9F27929EAF4FED2711B5794276E55B4AC06279D1944A8637DDE93C9FB818F7089A04BAD0FBD7FBBAE0F600817E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .........................................................`.......L....`A........................................@.......D...d................>.......)...P..........8.......................(.......@...............@............................text...f........................... ..`.rdata...i.......j..................@..@.data....S...P.......0..............@....pdata...>.......@..................@..@.gxfg...p%.......&...P..............@..@.retplne..... .......v...................tls....1....0.......x..............@..._RDATA.......@.......z..............@..@.reloc.......P.......|..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\244a0c41-42f3-49ca-8a58-f9ce14c024dd.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                                                                            Size (bytes):1509
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.137637950167487
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:YvA/ohY5H3HLq8PBpn+6Pz4jX2YMfkueqR1pi7v1m+A/PVJIH8KI2NzglZNcTqmC:Yv8IY5H3HLq8PBAlXL+eTr8PVJC8x2N+
                                                                                                                                                                                                                                                                                            MD5:067AA700CAF41BAC78286D92C567E851
                                                                                                                                                                                                                                                                                            SHA1:996E5B9D013E415BCF3602DB60F5945790271ED2
                                                                                                                                                                                                                                                                                            SHA-256:1C290770368B43AED78C53DE8BB903F2E14DEC1FE9C8954B7C53442502122CF0
                                                                                                                                                                                                                                                                                            SHA-512:6644ECDF0BC49C0EB6A84CDD6D2C98E8A5F05A7A285715F3CCE70FE1B10CE3AF8995715254DEB03035D975A324CA8CC256E74B8E34C53FE0C407FC5B06109049
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"autoupdate":false,"browser_edition":"std-2","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"9ed7ee19-cafb-416d-9b74-1b5dcd0405fb","language

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-100.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2181
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.807674908350133
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:Pe+1prHq0WWdnFX5lKhqEiJVk10s5pqe/cme:G+1prHqXkhrWqEiJa10ae
                                                                                                                                                                                                                                                                                            MD5:B5A21B88B3D8A42DF265817EBEB742BB
                                                                                                                                                                                                                                                                                            SHA1:E0BE32B4FC158DB4E9783094CCE614922114B742
                                                                                                                                                                                                                                                                                            SHA-256:9635C074C9D8EDDE0BAF3111DBD7DB49CBDC370C4F729C80AC382949F32BE526
                                                                                                                                                                                                                                                                                            SHA-512:21ECE0DCF17B038400D09565438FCE8BE61746DAA0250F2FA9D0526BBA3D1CE6F8DA5CCE944EF8FA685C5EB6CF857B073D2A50ADA44A44A76D84813871FAA5D0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C......*..,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka|}...q.s.y^.!.Gh..R....t.g....F.......gt..6...7YjaU....0.*.......3..l.#.. =.h0t.06.v..C...T.}m..%...g..i,Cq..8.g.q..hx. .>..Kz...1....VF.)..q..$....._Z-.U...(....~>...-z]$.mh.%...e.+.....|.n.2..:...N._R..x..>.|S......i?.P....Q.F.d..U.8..i...T...........I.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-100_contrast-white.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 150 x 150, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1828
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.716814612583543
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:uIrxqF+qFL9yUaKagPWex0mLgIbPdyFKD0YTkogFey6mkAN7G:3wFRoGagTx0A4KDfTko6eCZG
                                                                                                                                                                                                                                                                                            MD5:0BAE0648C3E320C4D439F158B4FD5531
                                                                                                                                                                                                                                                                                            SHA1:4E860AE24F03522C89BDF37F3CCC10B54832861E
                                                                                                                                                                                                                                                                                            SHA-256:28CE8FCB22080CE1F69346CB0720BBE5662959E413426F00062B706013DA8C28
                                                                                                                                                                                                                                                                                            SHA-512:6A5E4105CCBE1664546798DB057B93622C9CBD6D5AF4967E6BE4E390A18FEC0FFCC807E3331F09ED0DE63ED85569BE7EC5EED5A7C663DF6CE4A5B70E09500371
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR................i....IDATx...i.]U........J..RT.H....T...seV..)b.B.5.@.a.Q..P.c. 2E....eR...P(.....P........I...s..v...y...u......Q.EQ.EQ.EQ.EQ.EQ.EQ.EQ.EQ...S.n...j.."....p..|B..]....>.......9.32.....Y.l.R..*y.\.8.4.....p.K..EY%}.5.h.[*.|.V..i.F..q~...;..W61.M5_..1F...Gj..IZ..u. ...*.w....oS..D.r.).U....j.y.#..y..U..;S.-"...n..v.^i.UW.j.hk...n.....,...LRe[.i.}....H.z@.9.q..".v.U9.""n.)....DD.iX.b.....*'....v5.#..~.$.7.]..Tm.....i......+....m...x.j_.'"NG.]..n.j.vl{..Ls...;.T.=E..3...1;.v..xB...*"^.1U..8...xL,7]...D.9.i.."..N.."...c..D...X...c+.t..8M...[......"f.........R..0R.1..Xh..;ND.=U.ID.a.....v..8...'.uct.....k.q>.q.jc.+b...F....r....AN.....}.....Y.J.k~.;4.3".U....s..$....n.q.b{.q.j......".Y_..E...b.=.S.".4...[...S....Y.6O.L...."...."......i../"..!M.>..4ED.....I..""60x.Ct.i...4.."..f..`(.....4..5.L....o........*W....xX.M...E..C...r.....U...8..<'.G.}D....E.k!.8...ED..iL...V.8.."b.C3[Dl..gED..^....-...NDL.iBs..O...`m..zW...k.A

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-140.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 210 x 210, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3140
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.81304512495968
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:96:X4+RWiQZwj2bSjtW8+i2elETWt5nQ1pzuiV8:ozEW8+iZECt9kzuie
                                                                                                                                                                                                                                                                                            MD5:7E529063A02E4E83736B0263CB1B82E0
                                                                                                                                                                                                                                                                                            SHA1:17A3C4B76962E90B1D2FA8A49441157949F4DC78
                                                                                                                                                                                                                                                                                            SHA-256:A36A13A5D5E3D39E3018CCC5F8859944C87256F8BE24A3C08A6BF3CB06A26804
                                                                                                                                                                                                                                                                                            SHA-512:571806725F83FECA90360B246D167A8857EDFD9EDC8DC0EF7EEEF80F291FD06088C405A5653513CB8AA309DF08CD609DF85A95E3379E3E5907566C876CA77CDE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............?..B....IDATx................................................{..dg.8....m....m.Z.m..;;y...s.GI?..Su..k=.T#..#.;..}/\.g..:b..a+.....t.A}...q..hq.-.}...`:.gk....tm.$...Ax.....B....c.ih....G6L.....;...T.U0...l....~...........W....=<j.....X..O.....r.Y..-..Q..1.....q`..PC..jL...x.'9........y.b=L.m..(U........a.....W......`:.Me.jh..U0.......;..{..I..|.W..C..4...b.nt.......L..a.........`9.!..7N@.......E.?..$.._.q..6..":.+`....W.O.G>o.F.K.c..G.28..Q.....|.....m..#X......N.P..{:...1.........4...F.....w......Z89.Y.w`.L...v.DC.h'......h...[=...c.2...&ze*h..t..j...@?..cpN......0...KC.....f..F.....2"...c1..m.)y..q..(..C,.e..!w.N@I..q4.......!.A...;q..Y..sy.{...."L.p..#<...'.-8.!u.C#...O;.......y<.=....h.c<.=...5N...s....._...p,..Ia...yo....=...Y..4...t.}m@....g._.......#.M{...t........t...;.bjh..l..84.C8..z....B9..[.D.R..}...r..e.pl...~.....<.~ `...Ep..b...L.^.9..x.vB..IZH.a,k..c..L..U...M0....}.n........H..<.!..B.(Y

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-140_contrast-white.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 210 x 210, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2659
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.828610258666657
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:zQX9JrPPPPPPnouwOlIbylOhFARjcSY1E1y0fAiKb+Y+GzYvpSYWTX5sPPPPPPPn:z0rPPPPPPojFby+m00fAiKiySSYWTXqP
                                                                                                                                                                                                                                                                                            MD5:EBE7D27ED3B4CB6566A10165ABFAA941
                                                                                                                                                                                                                                                                                            SHA1:FDF7C27058CF5DAF7061756E938A33C1BBB26C3D
                                                                                                                                                                                                                                                                                            SHA-256:0BD63FE653885286E180FBDF6D1DADC66AF242B8ED6BD1D03D8C5ECCC20E91D7
                                                                                                                                                                                                                                                                                            SHA-512:50EC8592D78F00A6387F06E077E0DEF88DB26723C0FB8632C4EA06F2E09488DB0FB82E0EB1F03DA53F9C750F6CEBD29F7889B1DE342E4F0AE69F88C4B7B1425B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...............V....*IDATx...{.]U}......"... .!.#..D .k..:.....5...6B..Q@+..lq.(%my.P..C-..Eb..<L5..<C!.1.$wu...f..}........5..Yk...^{.}..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)u.d.Y.b?t..Q.E.,u......$o.-..rK....nw..7..w.TF..-...5=.r....?N...a.N.....~7..7,...r..-..q.}..R....Ye#y.u...IF2...Z..6.o.F....R1<w..]T..H..zw{.k..Y.L.Fm.k.ay.W.P.....I..,5G..C..........v.]...].-R..A......1.a;J-..>E....Qe'............#^VF.J.J-.....LRe.....|....g.M.e.+<.l$gHM.l..y..T.s#.Ow.o+....=...4....P"..J...("...]...~....z...h...P.*..QD....Fg.a..7m...W.`.j..C.q...E....D........8.i..D...^c...J.,.../.&rH[M..9.4._kfzN..#..bD.....[.D.4M3.....2Cs.........._k.Z%....bs7+...wkf...'.%..D.j..!M4A.z-R.k5.....q+-.*&j,..GE......p..(.j_V"......i.M...7.....E..LUz.8>i..jm....[.T.].F.%Q.;.2.....X.x.....-...b...;EQ..dU...avR[..V...f....`,.....J........K...........NWe.....Z:YT.>..{....-..(.uvV......P.x...m..ku.)q..Z>9vU;.)..xTC........j"..ra..D..(..6...t.Ib.O.....D

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-180.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 270 x 270, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3904
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.301300867894784
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:Fe0zdfrjvg/ofL7NkqKgOL6bq64wL3XtakhXSTxyfO8cg7WZUScsO62vSQ6Q4MCR:JdfrYoDdbJlXBRSMoj6H626Qr45eg
                                                                                                                                                                                                                                                                                            MD5:F332E088E89B88070EF1EFBECA5B90F8
                                                                                                                                                                                                                                                                                            SHA1:86129A8B1E2E7F78D6CE23C58A37FAC9DA5E566D
                                                                                                                                                                                                                                                                                            SHA-256:6A8F64754C75EDCC9ABC1138E44ACBD7064D7E8E2A28783939241DBD6AFA30A5
                                                                                                                                                                                                                                                                                            SHA-512:2314AAE692C024F914661E46CFD76531DA6C09B94C084FE915A0594625927DF30282D09518A950EAFCFDD2E499B1E4877CF3CDBF5509DE0CC756DADCDE43FD45
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR.............Oo......PLTE.....N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N...*....tRNS..8Uq...........jO+..D......o3.0y..b...g..a...@........_....d'...7Qp......K;..^h.\.W.../...S....-..J......&......Y..I!.P.w#...uT |....:.V...1.z%.Fn.6....N..L..$.2.?.e.s".ti

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-180_contrast-white.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 270 x 270, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3673
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.8322183683928195
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:96:nBWR5fosUcvpqnOtkeU4ghCboMmSaj+5UZy:MvHUUMnOtpz4Csz65UZy
                                                                                                                                                                                                                                                                                            MD5:98B9F7A4F4322E7B46DE392FD20F66E5
                                                                                                                                                                                                                                                                                            SHA1:D009D227522206C40CF592E460C9642CD03B8769
                                                                                                                                                                                                                                                                                            SHA-256:A706B332E6A846357A86C30D0E8BB7697E7DD55C2AE592DD45611DDCE0C0BF14
                                                                                                                                                                                                                                                                                            SHA-512:3B3E5BAF3CFC57119E0812DE2816DF6C7DCB42E96C4891E47C4F32320FD3BE2F27A0118051A6651595BAAAA30069BB1C0D78AA701744A44534CABE7547D4BECD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR..............1.... IDATx...k.u.......:.....*.o..I..J...L.H.(a...1....6S.....b.6..2M...fD.M..TN.5..o qx....;g..}^........."""""""""""""""""""""""""""""""""""""""""""""""""""""""q2.3Qr..z..<r....D.w.2.".r.*...s.......\..)d+.XJ.A........8Vq....g...vo.%..B..._M{.a&.XZ;.|r.v%."NaN.Q..R6....c.cN..~H..M1.X..a'%.d,=iZwF2...;.l.xU.H[..i.6;q.....#.y...w...... m.$~..$...L\E...l. .IM2s5.==.%..-....|.:,.`..........<.c-.".\....l...3...j4...B.sn@....Oxb.%.....B......$...-...WC).j..ru.s+.{.2"..5.c.q.e-...;.`-O1...@.G.F3.El.'..>$...(....d....6....%.CG\.e.[8.5.!.#....`q.3.W]X.%...$y...&...DZI....K..W.x.....%.......H+.O%../..n...~....C4...9nAZ..`..F...2.S.khhtz.E.(.CX....Uf....^&J:..@....$M......(.2..U.].O'vc...mzxlm....obq.M6....,.."H...}J'\yll..,....Jx..$/..X.uH.&.].....r,P-...[9.Q...Lr:....(..>..|..;.h4V.%y.|.]...$#....[[..d...U. ..B.H9..d.26.#.w..5.b....q....oq..0Z.y.NP..1.c.V!!.D=.k1.:.?.q'-..w.]..B,P..B...|....+X....j,..2q....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-80.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1723
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.769427546963699
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:MtXb2ikqrN+EMaUeTPMSEGS6CT/GF2MdJtDHBkZH39Hmgwiw:CXbzrzfUsUGS6A/ETJtHBYNG1iw
                                                                                                                                                                                                                                                                                            MD5:1F2FB1BF463B2FF2BEC96784DEBFEF84
                                                                                                                                                                                                                                                                                            SHA1:AE6F721AD937FE39F86602F71002435B18BF1EDD
                                                                                                                                                                                                                                                                                            SHA-256:7E6B0D9EA7FDA1B5CA7A0B01290521DFF943DA4CBF1498412CA7D749DB42C32D
                                                                                                                                                                                                                                                                                            SHA-512:0C92C4F75E620D0B636CFD83E89C69A44F6A96A00006FBD0B13637BA5DCC77C9B302029E62F4B80766811F31810F9C20AC1A98B65C38789951CA0E19A5BB6894
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...x...x.....9d6.....IDATx......... ..................s....P...m.m.m.m.m.6N......w.......-...g2/...)z.....K....~(^..`...j...z.^Sc.n.,.....0.VW..al6...a.....R0...k.Q..N..P.x.J[ol2..)o...A....x.....c.m;F...t.16.....L8....vb=AQ0.<.X).@....M......g.....k..,.AN...-..R......$....b..`...... %H....`6.g#..h.]q..5._.@dA..c0.;X....a.. .2...~..;.1..:.x.....q[@R....,4.w.v.._..s;.b..s.Qu5..U.|.6Zj...P..........\...qa. ..D..W.L...c.~.....A...F1g@x....V..`..,..D.=..d.i..Q...o.c...N......$.`....]...P}.G....BT. .?.......L.n..+nG./..cC.>0.N1.\.C..B..4.l./L.3....T.c.S..bf.0..t...J..!.aU..p`.....0./..}.iL.).w..hc.M..'.. ..;'.p.Rt....R.g......8.%14...S....<.Jf./@..U.h'.G.R..D.\..z.4......<....*2K.S.bj.1....=.../pd.........cfPL$7....S[.M.%H.M..W..T...ZP.aA~....D...+..~EYK.#..zOZ.]fA~...fz..].....7.>..|.........[...v..M..vb.........L....z.`.P...X..RP{.....`...+.0...l/..>...i.w...W. .....x....T...............t..+B}d*`/..+.;L...J..._...iC..pv..gA~..k.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-80_contrast-white.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 120 x 120, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1425
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.721284228612739
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:sRv0SxfL9UEp3g4/RjUG894TBRVPvhjfghucgXy2nRlWzIXQuohMU9ocyMDh:sRv0sq4/tU10XVPZjhy0Izy9srWcyUh
                                                                                                                                                                                                                                                                                            MD5:17471BB63ED62A6E545B6B626A763511
                                                                                                                                                                                                                                                                                            SHA1:586B9EFDE7B3A04580A49F8FE7739593D42D303E
                                                                                                                                                                                                                                                                                            SHA-256:DFD1054F989CDEE25F19EA792F363F042A125CAB537A424F0224BBEE13607E39
                                                                                                                                                                                                                                                                                            SHA-512:F619D963B62EDB07C8077C3C6AE60ED8D3F3DD5BB1D05A2B83DCA1A7A4A346598B055F6C7EA22E05BF281B1DE0F205F5D1054819000759D9450EE1FE8F6491AE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...x...x......m.Y...XIDATx...m..e....}....d...9]9\...r2..L..37...S..."s..SV..].t).*.I..dh.Em..`A ...9.`......./..u.}...........v].KUUUUUUUUUUUUUU...~.p.....M.6Y..l.]...Fv..W;..o..d.l...r..{.d..r....a....r.y...@..>.z..C.l.qh............7{E:d.w.W..ZD.2[.~_..y^4.q.!./;GK......Z."s.m..9...{^.g...g...i..[$"F..x.Pj9.b[E...,.q.^.......v. w...4.I.E\....D....9......C".Q.._El0].=.Z`?.>gD....&Y-b...+E...(.f..~`..."^....Z...:\.h....S.v.v-KE,.8.....W.....Ag.V.....q..yD.<..6....x.d.N.....d..?.Q...[..".WZ&.,....v......Z...vG..k.4."...tv....".T.K.L.q..sQZ%.M3V..D...D.!.-.T.*b.n|W.u..xVl....X..._.."...n...5...W.?.1U7Z...p.>#.R.p..#QzJl.;D\..;E....Q..zl.w..wD.4 .j.u....D,.SE<..Bl.........U.Z.[D..._.4K..u.....mJ.e....&.m......-7*..X...:T.K.}..;~....."6(...O..(M..=.#.q.{..xHl..E,...v...3.`......X.[.E|S.IF......C.b.....r......9....o.\.x..WM..J..5.&.IJ......|...........q.J..!{t9L.Y.}D./5.."Vv|./4V.v....i...8Ji......ae18...>.q....0...X.,

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-100.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1564
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.78686155071436
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:kO3Sxd5HLMZAoBjXkaBPxrX6hzB6eCvTYJSM2nY2YptQ/ceAV5ulBbYZwix2:MLLMWcV2z8nryWY2SDV5uPsqiw
                                                                                                                                                                                                                                                                                            MD5:C3722E0232EC20AC8F99CCE7A040B294
                                                                                                                                                                                                                                                                                            SHA1:91CA47DA87EC045ED3EF5D97243167F08FB9E10B
                                                                                                                                                                                                                                                                                            SHA-256:A333D7E4293F5269426B3FCB673A284F3708A66F957DE62403B6570B24BAE8F5
                                                                                                                                                                                                                                                                                            SHA-512:71940B8431E36307BA5176939A169B9259BB6B43C32529A10A12C5EA31447BDDCCAD7EB9EF7CB309B175EE7BD56E70926BD5AA0855D0FD9497547ECD7FF93158
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...F...F.....q......IDATx.....L../..m.m.m.m.m{.._...+...d...[.|..y.'.{8..N8..N8....x0..$.iA&..d..@r........&X...../.z..../.....{..../u~....|.._4$5..4...6....q..P..D.U...u...W....o@#..j .o....j...r..MI.n..X.RI.]..W*g.g..;...|.D...2..._.#..$.....A......I..r..GOF#F...L)..P.8.....G.. .l.m..J.=(+.{..@#....CH..|.:..n.%..0..*.{...O.+.Q.ORp...7L)dxS2H..Ge....e....$..k....iJT.~...eZP..A2....g..PUB..|....v.......>..k..~h3...40.x...(.......v.%.F......vl..h`>...P...4...W4.D...\o.9...z....3]........`.}t.......XI.[z..%....S<.e... .D..TA...'.....h....l...,...$7.......0,%....I[Au"...d&?.j......,..|...~F..pB...]......L.]d.v5...U%..h:}%..._.$...X.m.....S.yL...Bc.R;K..8...*..TiP.}5.g..p..m..s].ZU....H.{P.!,..?......t.U....=m-<.a.v..I$...u.T5..LG..b]...c6.19d;k%...3......,..I.[.1..:...YN...h.*5...W..._....dL6.v.Rch..~...i.1G....|].AU.k...H.[Q.a,6.5-....Gt.9U......n(.#...D.v......_.*...@I.}...i.u.@..w.T%..*.&Y.:o.X..3.Z.m..fW..5.....D...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-100_contrast-white.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 70 x 70, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1341
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.829707677562043
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:vHNfCYvjHq3yow73tnF7H1r8IR07iBa/ptAFjLmocqM3LNpi+MaG9vz:vHsY7Hq3QzT7H1r8Wr0/zAxfyLNp1Pab
                                                                                                                                                                                                                                                                                            MD5:504D80D276ADCC0163A8E4720013F9E7
                                                                                                                                                                                                                                                                                            SHA1:6D34A0593FFCE916CD19B66D61004FD7E7EB2CD1
                                                                                                                                                                                                                                                                                            SHA-256:EBBE0B4761EA8968A0A3FAFB383AC7AE175E98CD31A0F41BDF5FCB43469B58EC
                                                                                                                                                                                                                                                                                            SHA-512:9961259704FF97C0E1899A33259F62155B73264E272064F3FA90E64124513C7C8BD6AB69A39C1EFB271ECC2972AB8FD86FB836F22153A9BB35419C3816D11337
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...F...F......'*.....IDATx...{L.U......#A../.9S.&:/..%]ti...TL][Hm.n..8,gsZ..Zk....:u....lF...".I..[.H(.q...{.sx.</......y....9.9.<."""""l%.J..2.L...xFp?...?.8....:N.M..`2.i..M.uZZ+'..C......9.f.1.X.}He....b...$..V.."..'T........[.s..}..F.........t.lnK..d.5...Yr..ld..x.\...iP... ....X......a ...i.C.D.E.H.&......Y....h..G.....1..h..C..>t...$...m..+..../.<.n4.."..(w..%,.R-...t.$.?..#.QB.+.ep..-.....r3.LYo....A...1CVK..$=.ER....}.o.m<.....#....D]O 1\..}..^....,.|[..L..j..`...n.,...C.N.K..U...k..(.IF......1.....B6..X..U......oK..cvm...tP.....,lM....iAq.+...~.t..M.&...0......i(.y.Gq......Zw.,.H.|... .H...zXR...>....K... )S...E......V..H0UR*...P.....\.I......n.fj*.*|..1...U(=.....~@=.X....Hq...4.....D..4S-...x.t;.....X0.....`....j....+..X8....z.t..DV.6c.\....=Ri2.y.{ac..../Gv./....X.n..o....x..ha.d.....p..V.QRg....8...?.[Qrxo!...r....Ni.4tOHz...Ca...z.K....er....3...;....(.0..[r)6.J.3.S'..(.v....l..~t..".&Fwx..M....P....>.7.E.Z.Y.%.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-140.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2005
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.837796638299837
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:FtyHJuovwDhlXRvUCvqfPAuwdESKbtU04aQkClnRU8lbPxbsFIV4hEIA:FtygGwDhlX1oHO4KwCAQ9MEIA
                                                                                                                                                                                                                                                                                            MD5:667BFBAAEB2D2B372B6E0D4BF4992CE4
                                                                                                                                                                                                                                                                                            SHA1:4C6C2E07183963F59391945FBEE077B55F8F6B2A
                                                                                                                                                                                                                                                                                            SHA-256:207519F1C7B6C7509BFEB7B55724997EEC6456C8BAF55E882E72FC5CD43DA221
                                                                                                                                                                                                                                                                                            SHA-512:AC63A3DD2F6088E7849E3824C35FD58CA78EC77DC31E1F6CBD47DE7CC394318CBA7D2309912206A94180267BE057C2AF5C835424019E2A03EE33A2AB801BA9A4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...b...b.............IDATx..........S.d..........=...F...m...5.r..........m....g{......[1..q./.D.B."......)h.a.o..x.p..r....]..\....b fR......W.a.."..Ix............58.G.G%D.....0lE..E1D.<...u<o...6>....-.`..FX....l\.....K.....{..Y........D...............B.<G.....7.5...8...\....?.!j.b..F..PH..X....8."..,..R....X...((..G.0..&~a...{..DA<v.....H.4Q.u..a..#<Bk...E ..b\@'...3...U.\..4M...o.m.m.m.m.m..$..R9......&..NMW..{..4].....m....h..y/..x....a.[e..7.ua.^.lC8....l0....1...r.&........G.......c.....d....F]...M.a&.M..V..?[..t.P.Xx...*<.(...s...'.Q....'.~{_......8....R.%..7|O.Bl......Sr....^..@..........us.".M..?x....*.T.....A....&.l........H`g..."...I}E.7..].=...C.gz........V!.EE.....7WvB.!.d..vJ...k.{?.......1.n/.Q.{.....LD..;k...\....]G..S.+....F3.}z.=F(.....$..D.[.y.... /Q..eU...]M.[r.......}.f.s..;..!...s..C...x...Y3...<....0.O.p.\..&5...f.u.....4..A..".. .lD..7.#..P.../.i. ......+...M...}/..U\...}..Ah3"t.....D...!v..V$

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-140_contrast-white.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 98 x 98, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1697
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.76630495035972
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:TyhJvOYkuSoLYIWawZM7SkzaacHxXgr4RzhQpKP7C:6JWiEIOuWkCxCSzhQpCC
                                                                                                                                                                                                                                                                                            MD5:93223E8777B581E988B703DF82593B17
                                                                                                                                                                                                                                                                                            SHA1:40A035464C27041CCC87C7935C45100D93D1C948
                                                                                                                                                                                                                                                                                            SHA-256:464AFAF960C32ABDC2C3937A48BF14C5D1A819B017E719FDED591D43A65D94C4
                                                                                                                                                                                                                                                                                            SHA-512:B8A3EE4A71E609625EAB51F0F6DAFCC82CC47BA2C567CC8BF73CF6423056F9171276289BFDCC8428B7C07645097664065EE9B0B78874425BFF800178222FED12
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...b...b...........hIDATx...........9.Q.f..ttS....u....%..1.a.s.!f..c.b.b.K7QFg3..Y..2M5..6:B..z9.%..N.s>9.{.=..........|.7------------..QNt.G..].E.....b.s.e..X.C...Q.b.;.p..m......g....L.\te.G\.d...F..X..=f..]y.A..\e.t....Ei''...d.X...X..7[TYh.1J..g...y....]/.,r...........mi..2.6J.6Yte.....g.....<o...;..v.T..KJm..\T....i...G.."Qe.c..1.I.T#.6...2...7.y.K.*'.....p..J.2S.V...zf..Z%b..Z.6.z._j.}K..w..R.2.Y..M...P..l..d.JG..Sm..0V..o.u.'R..6...(U.k...k.+m..i].n.ub..D.b.JwJ......-1..(. U..|.^....(."UO..z;.@,2Vi..D,...;K.NAi.."f.TO.j.XlO..}$..M6..".iC.."..MO]-..[(]"U.i..E...J.K..zn..".V..M..i....q.(=%.5...R.e...:P."..(.*U..[...M.G~C......Q3)..]o.%U.*./.c....t..:J...q..k...g...R....\...A.@.kl...H.vJ...x..../....9.:..?q...Y..":@i...4f..E.Yi.T}^.....Q..#..h.#"...4S.y.l...AiG.kl.QWI.nJ.E.F.}M.tP...9...U.f..g...../....]..U:N.{..B..A.2..i.Ru..A"..+jg.kE./Ru..R.g.D...n.q..X-b...f...b.+.q......gD.Y.....q.....t..kA.."&j..Ru..."...j..D..4n.S.wD..gG.x..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-180.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 126 x 126, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2699
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.8799233652993115
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:Is+9LgA+9fj19UhKwdgrviOztr/CrWbqCLRTFxFCEEgq0Ol81sqAGz:IlSN1gBTOztr/jbzdh1y0wl1+
                                                                                                                                                                                                                                                                                            MD5:704D0A2693B350E7C463B0FF2143835B
                                                                                                                                                                                                                                                                                            SHA1:0313AD4C3690A590AC54552D2C27806E73776600
                                                                                                                                                                                                                                                                                            SHA-256:D6367DBC074E37F3488C26B0BAD229BFE99F5C6BB0E28D37B41906C436152B57
                                                                                                                                                                                                                                                                                            SHA-512:4517B2FA911149885EC5549F3173D3C774716740826873E4B2199C804B17E776A5296565930E5ACDB8D5476710A391B21E6DA8941DF64C525A487DB4619A1EA7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...~...~......#.....RIDATx......................f..`....6..m..j#fm.qm.Am.m......%_...q.i-.>dh.........q.o!!..]...LC.TF..D.o.8...8.O..|.iLC#$PO<..1P.....wX....J..<5...$`O1.YU..g.L....<.....h....K.4Aw.....[.I...yU)....D|..x......`f..................9f....Y...p..!..E..U%...]......l.#.....#gPB.5...^C4.G.........g...5R... ......W.~H@. .*....8.....G...N.U...c....J".....YQ.m0....b.5.V.Y....:.......(W1.E...yb.,..a.bT.^.O!a...6...+!:.*..|O1......ZQ9...M.6.....!.6..O.XI...#jF..w.o.#|c...%Y.h.m.m.m.m.m.......8.qog.N.....3.}...R.....8...P.M.....].....B......3xs...:M!...K.;.mL.7l.N..=..7......sfJ.;..|Q........}:m..08...y.+.5...D..:....|8.m.]........04Z..b.......c.r....|.....m.6/..!...Y..)4._..0KY.e.[.qL.!...X ..jk.....|.....Ki....q...28...-.....<....4.d`.Z{.-]|B..3 PJ.gP.iW-..]m..61c...8.b.,.. P?&.0........A..!_k`.\.s.>.......d..R...."*<.e../.A.S .+...O.Oq.&.B.Y.6...S.!W^....... ..3.A..*...GA.uX.|[..Oh..=..[..9....l-.l..+...mM..Xu_.#)..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-180_contrast-white.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 126 x 126, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2334
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.8839656878677005
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:W/zeI9zj1u/VwgVNR+vEgxOfU99BpcZlp9uqRhq4eZDU0BMK:W/zn51gxN4RxH9hUlpkAMt/BT
                                                                                                                                                                                                                                                                                            MD5:39E2FCF13C20103C5F449C06D3A4CF75
                                                                                                                                                                                                                                                                                            SHA1:AE8E1BCE2BE17ED450D891864E6AA22642AF39AC
                                                                                                                                                                                                                                                                                            SHA-256:5D46E4056F3915C279F1FA9EDF61D93529FBCAE5C59D616380EC5D9405B7763D
                                                                                                                                                                                                                                                                                            SHA-512:8E4902262B064008804D49D1B5F27BB7B8F33ECEFB05181AA69534E1D21662719DD4F8E0677C58215F6C5CA9EB4FB92FCA54A89F9720230AFBF06A70216ABF26
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...~...~.....H*m.....IDATx...{p......1\0<.%.1<........L.(.0P....R.(Hkk.3.>(-.X.t...>.Q........#P.H.JECxZ.<...5...${.7......../...g........x<.....x<u.0.Y<.f.s.r..7..1.Q.#.#...X...C|.r.......h...b.e..D.[.H..RG.q..f\.9RhV.y....<.Z..0..K.9.c.s(.C9...d=.4..YJ.V....l2..Y,.....u..kH&........rFh.Na.k8A%J..<.-D...Wc.EL'..T~.......I.........N..F...<E.Q$.*.-N2..a.D..;H Jt..%q.....ml......3L$.n..-.Ha0SX..\.#..w..28..W...Z.......Y.......o.......v5.......|...xv.X.G5m.e....tzq.e.7.G.r..Q...D2l.^....E)J..14............~..HCg8...JZ..TN....id..l...3.Vz9...` ....%3.F..v.JG'....Y...,.lc"-.K.]y...h.m.0C.I....".(Gq....g.S>E#....C..+.....].u...+..I...g....b.H....3d.S =.O,.7[...q.|.6/..U.U(.ed.,....DX{.JA}.im;..)..ld.p.*?....QK.....H..i.....#.~&=.&....pZ..&.2....J.s....p..r...y.e.....c..3.g.H.z".#....C'M.h...?......v...&"...z.e(i.+Wz].....<....?....M+s.&....d....*.0n.....s...<Ws?I....?.{...`5z3..w8.........s.B.d..K..K....LLY.j..^...a.p.~.z....-......l.dM.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-80.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1096
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.755097954664401
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:TDh4JYYFMId219dZt07Zcglb4iS/cFEAAabL3/006Fs:B4JBMPVEbCe/006Fs
                                                                                                                                                                                                                                                                                            MD5:32D3E390613CDDBD639E70DDB2511AC0
                                                                                                                                                                                                                                                                                            SHA1:C96AC088E72D756F31896B16776EF100379F802C
                                                                                                                                                                                                                                                                                            SHA-256:DC20E5AA2B500CD5B5C9F89647D3487810685C94268F22678E27820E2454BB3E
                                                                                                                                                                                                                                                                                            SHA-512:7381CEB8FEE84F398082177F30DC01593BEEFA729C73B0166AF686BCD25D54312B202D9243834B754769DE41E9A1DEED74CA91A76DCDA918A749CDB4F08C124B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...8...8.......;.....IDATx...S.,I....[k.m.m.m...k.f....0..Ag5..<.w.1...r:..g.+...+........MX.k`=l......\(...........,vDq>.......x..`wl.U...x..[.....(..p...@u..z...1M../.D>...z..'vJ..U..'C.......?c:..U........GQ...,.P.T<...-..|$~....q..n=L..iF....X....q.......p.6{q8.u'*.R..C...Qg..YCN.:........#g^.R...w.......U..j...H5..eF......iO`..4r.R.[.....0...9{....u.v....X6!>.F`*.Nk.....J...5.P..}..F.\..Lk._.`.#...od..7..4!V.......-...{r.P....9^5.2.(.G..OT..<9}1....A..Q...U.{C.....o..S.....S...b....z..T...o....z..Z.xv......O|.8.....u......c...?.....u.u........p4.v`......kQ..4.....jzf.^....F..4...j:.._K.;..z]..0.0>..........|..W..Z5!6.b?....2O.....,.>.Q.y..-...._..k..w.}.V....s.o....W*..._Q...X..=Tcmc{N.P..1..j..'...l.-.?j^2..*~}Zo.J..7..F....D.91.....#2^..7.}7........$.:P..oc"6I..)n...|A..G.....l'..x..bM#.|...e.yT...k..y.]9...2.ao.z~.g`4....e0L..........t....n*.....}D.>.O..Vv..vE.Qs.\.~...s..........v.....T..7..A.9.s.]zQ...Gb.q).2....e...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-80_contrast-white.png (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 56 x 56, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):901
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.682141855410327
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:24:x2BZqWXRHKkqILfEDtySHnb98XPA8KWstHNMufZ4jJO2C:xZQEC8BywBmPAGpC4jJa
                                                                                                                                                                                                                                                                                            MD5:E6ADD5AFC73F7B06FC2348550595F8D6
                                                                                                                                                                                                                                                                                            SHA1:4D658BDDB93FA6CB423EBC61BD20DB37E4D37DB6
                                                                                                                                                                                                                                                                                            SHA-256:DD6F46D32C3E235508F9E4C7D7F993BD807D955BCA7E63CF3D57C6C4C102F46D
                                                                                                                                                                                                                                                                                            SHA-512:55437DFEA7F68A4572DFC86B5428CBE9DB86C0D32D0B09BA6B7B1CF8E49E5F1BB94285BBDC97D8EE00D70BA75921DB59644787C1BE1672FE37CEE09441F249B6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...8...8...........LIDATx...mh.e...c....#.."aM..f!Dh....eFaa......0$3.a.bS.(!..$..@%1-+.,.ge..\.9..=<...}...=..7.\'7.-////...T.2.x.F...Ur.5.v..L...Iv..-..a.1&...Y!...U.S%..a......k.V!=....'..M.Pl.F!..s.V..B8g.n..9a......Z.k.....vH..i]V.Yx.....ve:R.I-.c.d...\......S.s<.?....`....).Ab.za^.s.1....~r4[...6a.......$6.o.I.z..A.Z.HG.:.r.C..E..<+.#Q..P.J.._.xYX-...[I.'l.o.{...Q.Y.E.'.V..3...H........i'.w...........:a<...W2.I..0P8(K...IL.V....).V......=". .....;.,....F&..U$6.....d...e.T.}aK...4I.!.(.U."...,}-\G.Rx[&..O...$Kk.I$.k.[&..c......S,.v.....(.Ao...,...K[&T..|.......G.G.6a.++t\..*.?...La......F.....r9..t.U.9.DG.8.o#..j.d..L.~..;B....e.f....*,.......b{./.....N.......`.e$npL.U..f.j.I..A....Oa.^.F.N8`...xU.........@?..t%$.,...l.n)._h0/U.d.....l.C...I....R..)..........3H...N....h.9j.2.{.n_...y..m.9.5.^...H7.i.A.....e.?..R....]....IEND.B`.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\Resources.pri (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3072
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.118957212117411
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:48:Whs+6rek/gF1A6Gbi+4eTy8iPTUucUITUuqQTUGUQTUsITU6UQTUQITUuUQTU0I0:WWnep/FFLxPoRJo+oGpoBo6po1oupop0
                                                                                                                                                                                                                                                                                            MD5:400817D0A91767CB830767AA94383F31
                                                                                                                                                                                                                                                                                            SHA1:73F36C895190223F94E4D52657F14454B2BCBA44
                                                                                                                                                                                                                                                                                            SHA-256:35D92C86C1C054D1C03F4E58B83681BBFD8573143EE5E4CFB4CBD788A1FFC107
                                                                                                                                                                                                                                                                                            SHA-512:2216DFC65E24961A18A4622FF6D8D8A1330283E64477A0E44BAC5B8F9A4CB5690FC90F598BBC152214EE6AA8770FE6608C4C809EC6F2CC73547D8166603B3E15
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:mrm_pri0........ ...............[mrm_decn_info].............8...[mrm_pridescex].........8...H...[mrm_hschema] .................[mrm_res_map__].............@...[mrm_decn_info].........8.......................................................................................................................................................................................................................................W.H.I.T.E...8.0...1.8.0...1.4.0...1.0.0.............8...[mrm_pridescex].........H...........................................H...[mrm_hschema] ...................................U^........m.s.-.a.p.p.x.:././.O.p.e.r.a./...O.p.e.r.a.....................L.......................F...........A...........O...........1.../.......7...!...................................F.i.l.e.s...A.s.s.e.t.s...O.p.e.r.a.P.R.I.C.o.n.f.i.g...x.m.l...7.0.x.7.0.L.o.g.o...p.n.g...1.5.0.x.1.5.0.L.o.g.o...p.n.g..........................................[mrm_res_map__].........@.......,.......................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5819288
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.516225214128497
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:49152:ICS80y0IR9jrCUWNuxJ7ORElJw5H8WOWBCH0ckcW7qqm1YgvJbMUnFSy79m3e5RT:t00Rtiu6fJUpkcWPiZrFSy7PezefVPKM
                                                                                                                                                                                                                                                                                            MD5:84762F0101AE1F06BCB76F70A0308FD0
                                                                                                                                                                                                                                                                                            SHA1:401EA43542EDE3D1A877A9C0ECC4E95914ADF995
                                                                                                                                                                                                                                                                                            SHA-256:7C2DCD7606449D72BD4E54C2C6932E286F2ADA42C996E8F2B5043EFC915DD046
                                                                                                                                                                                                                                                                                            SHA-512:72E11FD1DAC04EFB622DFA7131CD7F8354B474A5FC49B8A60481E4EF850D10BAC554F811A667148B9081D58F95BA18D8D9D6F061274479E7D4BB2638E977FF74
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......2H..V........,........@..............................Z.......Y...`..........................................iR.Y....iR.......X..`....V.T7....X..)...`Z..B...'R.8....................%R.(... cH.@............{R......iR.@....................text....1H......2H................. ..`.rdata...+...PH..,...6H.............@..@.data....y....S......bS.............@....pdata..T7....V..8...pT.............@..@.gxfg...04...@X..6....V.............@..@.retplne......X.......V..................tls....a.....X.......V.............@...CPADinfo@.....X.......V.............@...LZMADEC.......X.......V............. ..`_RDATA........X.......V.............@..@malloc_h......X.......V............. ..`.rsrc....`....X..b....V.............@..@.reloc...B...`Z..D...^X.............@..B................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.licenses

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):14004
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.037159328058129
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2528B26988213FE5C0EE9CE75ACC2935
                                                                                                                                                                                                                                                                                            SHA1:D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
                                                                                                                                                                                                                                                                                            SHA-256:42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
                                                                                                                                                                                                                                                                                            SHA-512:F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.version

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.2516291673878226
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0589F66713BC44029A1A720B9A0D850D
                                                                                                                                                                                                                                                                                            SHA1:2FDF7D04F0372055C9D77CA43D9A3C08798905F3
                                                                                                                                                                                                                                                                                            SHA-256:64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
                                                                                                                                                                                                                                                                                            SHA-512:31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:1.3.0.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):12449
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.27994057204541
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:ADCDD4926BCC7C824A9225173D422F02
                                                                                                                                                                                                                                                                                            SHA1:1DF16167B195CE408626A64ABE98FF53510FAC44
                                                                                                                                                                                                                                                                                            SHA-256:3F52A7AB3F4E6AF5C06B00557F533E37F108AF822A769C13220BFB8EABC3DFE8
                                                                                                                                                                                                                                                                                            SHA-512:A8EA63EF34A33855388716353386D39EF0BFE41A2764D23B711D1468347119C9D2054C6DCFB89C6BADDB23097170D69FA0840974611D73CF08582479BFDC3C4E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"_all_users":false,"_launch_from_install_dir":true,"_skip_launcher":true,"_subfolder":"114.0.5282.123","app_id":"1730212712","channel":"Stable","copy_only":false,"files":["114.0.5282.123.manifest","CUESDK.x64_2017.dll","MEIPreload\\manifest.json","MEIPreload\\preloaded_data.pb","d3dcompiler_47.dll","dxcompiler.dll","dxil.dll","headless_command_resources.pak","headless_lib_data.pak","headless_lib_strings.pak","icudtl.dat","installer.exe","libEGL.dll","libGLESv2.dll","localization\\bg.pak","localization\\bn.pak","localization\\ca.pak","localization\\cs.pak","localization\\da.pak","localization\\de.pak","localization\\el.pak","localization\\en-GB.pak","localization\\en-US.pak","localization\\en-VO.pak","localization\\es-419.pak","localization\\es.pak","localization\\fi.pak","localization\\fil.pak","localization\\fr.pak","localization\\hi.pak","localization\\hr.pak","localization\\hu.pak","localization\\id.pak","localization\\it.pak","localization\\ja.pak","localization\\ko.pak","localiza

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1509
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.137637950167487
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:067AA700CAF41BAC78286D92C567E851
                                                                                                                                                                                                                                                                                            SHA1:996E5B9D013E415BCF3602DB60F5945790271ED2
                                                                                                                                                                                                                                                                                            SHA-256:1C290770368B43AED78C53DE8BB903F2E14DEC1FE9C8954B7C53442502122CF0
                                                                                                                                                                                                                                                                                            SHA-512:6644ECDF0BC49C0EB6A84CDD6D2C98E8A5F05A7A285715F3CCE70FE1B10CE3AF8995715254DEB03035D975A324CA8CC256E74B8E34C53FE0C407FC5B06109049
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"autoupdate":false,"browser_edition":"std-2","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"9ed7ee19-cafb-416d-9b74-1b5dcd0405fb","language

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\launcher.visualelementsmanifest.xml (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):317
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.996593526126476
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E8D8EAA4C2826C083AB9243B5CBD7BF8
                                                                                                                                                                                                                                                                                            SHA1:534361AE03417DFD14EBD6F961B707C75A2AF41A
                                                                                                                                                                                                                                                                                            SHA-256:B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
                                                                                                                                                                                                                                                                                            SHA-512:8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1493400
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.361678504526369
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:94851594215654A9EFCE5F3C3830A9C1
                                                                                                                                                                                                                                                                                            SHA1:C8E487ADBEDE70014AB12FE8CF546723C4AF46AD
                                                                                                                                                                                                                                                                                            SHA-256:3296D7B4C88F1BFC356A509622376B6BE8B103EF0C9A8D1D6BAF4A2E2C27606F
                                                                                                                                                                                                                                                                                            SHA-512:13CEDB13EF86653FBFEA33D16A732F20134AF8364D0BD3468F46ECD46D7424059FEC7968D4CB112ED248F5594F964ABE8CB3E643317E79C653BAC124D670A66D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."..................k.........@..........................................`.........................................h...k.......P.......@.......T{.......)..............8...................p...(.......@.......................@....................text...m........................... ..`.rdata..T...........................@..@.data...<....p.......^..............@....pdata..T{.......|...H..............@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\opera.visualelementsmanifest.xml (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):317
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.996593526126476
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E8D8EAA4C2826C083AB9243B5CBD7BF8
                                                                                                                                                                                                                                                                                            SHA1:534361AE03417DFD14EBD6F961B707C75A2AF41A
                                                                                                                                                                                                                                                                                            SHA-256:B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
                                                                                                                                                                                                                                                                                            SHA-512:8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\pref_default_overrides

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:99914B932BD37A50B983C5E7C90AE93B
                                                                                                                                                                                                                                                                                            SHA1:BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
                                                                                                                                                                                                                                                                                            SHA-256:44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
                                                                                                                                                                                                                                                                                            SHA-512:27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (928), with no line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):928
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.668014177318632
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B36E602204FECBD921DEC6B2ABC420FB
                                                                                                                                                                                                                                                                                            SHA1:C50B1BA588A240ABD068F63FAD7959FA5B2AAE9D
                                                                                                                                                                                                                                                                                            SHA-256:82383FA339AAE8511CF63BCAF418BC206C99686AAF7DE6EBF968D6E534C416AB
                                                                                                                                                                                                                                                                                            SHA-512:A2BEBDDE759411453351A2163DBFD4F7A0505CE36146C435824F5ECE228BFC825EA226E1A738315494533738A7B34DEF997F2556D7A6DEF7CBA285A2DF969359
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ==

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\52FCEE075297\installer.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                                                                            Size (bytes):7977368
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.942334984663354
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E169C65773E40654455624EADD122953
                                                                                                                                                                                                                                                                                            SHA1:FA5A9854596CCECE00D7B5058E915D8DB9A24881
                                                                                                                                                                                                                                                                                            SHA-256:A14CABEAB50A7CF712F2ACBAA8D43BAAFFBF883D9882A1FE49614CB8CD2ACA91
                                                                                                                                                                                                                                                                                            SHA-512:C106CA6A51C82A651BECE1703D50D66FBD847333871A11566E3B602336BB13AC17784114AC35FDD2507DBB7B0795FF699DED07AA35F7359C532CA61DE1D7AA8B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........."......,...^t................@............................. z.......y...`.....................................................P.......(pr......9....y..)....z.....l...8...................P...(....@..@............!..`............................text....+.......,.................. ..`.rdata...U...@...V...0..............@..@.data...`J......."..................@....pdata...9.......:..................@..@.gxfg...P&...0...(..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..............................@..@.rsrc...(pr......rr.................@..@.reloc........z.......y.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\1b9608e1-9b6a-4da8-8134-1cd19dbdfde0.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):280
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.000365094214647
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:F9BC9959D273CB0A94F2C854D1957E63
                                                                                                                                                                                                                                                                                            SHA1:975BE7F605E22D831506498B729718F657BD6722
                                                                                                                                                                                                                                                                                            SHA-256:CFB2A0CDABDDE2BA25FB5A8536F6EAF8A32E3F90CED6A68DD3F020BBDD4A6BB3
                                                                                                                                                                                                                                                                                            SHA-512:736EE3E8EF8154DDB2A2465AF79BF763B00AA63F71777A7947885A3130CA9B1D2F61CBCCB08009E16A28AE8288EC9DA666C0EC0BF6FF6AD680E230C5B2E34682
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"country":"US","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_medium=pb&utm_source=OFT&http_referrer=&query=/opera_gx/stable/edition/std-2/?utm_source=OFT%26utm_medium=pb%26utm_campaign=ogx%26utm_content=ogxi_34420"}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\Opera GX Browser .lnk

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Oct 29 13:38:32 2024, mtime=Tue Oct 29 13:38:32 2024, atime=Wed Oct 23 13:41:31 2024, length=1493400, window=hide
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1422
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.908851249711156
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B403406B202727736160745D10A66945
                                                                                                                                                                                                                                                                                            SHA1:48ECA54453289AADC1BD7BA7CE4788C5844A4EA8
                                                                                                                                                                                                                                                                                            SHA-256:7843CE028F124134538C0543B77C3D92DBB1915CC5FBC129A82B1C8BF64ACB85
                                                                                                                                                                                                                                                                                            SHA-512:CCD2872D522C4EEF9CE5B509E66026810923EF84F131E00AD344C78ABD6C28C1CA65EF220578ADBB960D62B99EEFFEE6F400C72E34A46D829D1DEADBE827BEDF
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:L..................F.... .....Q:.*....Q:.*......Y%............................:..DG..Yr?.D..U..k0.&...&.......$..S.....s..*....p:.*......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2]Y.t...........................^.A.p.p.D.a.t.a...B.P.1.....]Y.t..Local.<......EW<2]Y.t....[......................ac.L.o.c.a.l.....Z.1.....]Y.t..Programs..B......]Y.t]Y.t....`......................tv.P.r.o.g.r.a.m.s.....Z.1.....]Y.t..OPERAG~1..B......]Y.t]Y.t....q......................\..O.p.e.r.a. .G.X.....\.2.....WY0u .opera.exe.D......]Y.t]Y.t.....A.....................J.o.p.e.r.a...e.x.e.......j...............-.......i.............F......C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe..'.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.o.p.e.r.a...e.x.e.1.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........|....I.J.H..K..:...`.......X.......580913...........hT..CrF.f4... ...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\additional_file0.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1499104
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.985603261747699
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E9A2209B61F4BE34F25069A6E54AFFEA
                                                                                                                                                                                                                                                                                            SHA1:6368B0A81608C701B06B97AEFF194CE88FD0E3C0
                                                                                                                                                                                                                                                                                            SHA-256:E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
                                                                                                                                                                                                                                                                                            SHA-512:59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.|..6....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\additional_file1.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):242304
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.028776242997077
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                                                                                                            SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                                                                                                            SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                                                                                                            SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_users": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1499104
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.985603261747699
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E9A2209B61F4BE34F25069A6E54AFFEA
                                                                                                                                                                                                                                                                                            SHA1:6368B0A81608C701B06B97AEFF194CE88FD0E3C0
                                                                                                                                                                                                                                                                                            SHA-256:E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
                                                                                                                                                                                                                                                                                            SHA-512:59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
                                                                                                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.|..6....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1853592
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.818631706824549
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4C8FBED0044DA34AD25F781C3D117A66
                                                                                                                                                                                                                                                                                            SHA1:8DD93340E3D09DE993C3BC12DB82680A8E69D653
                                                                                                                                                                                                                                                                                            SHA-256:AFE569CE9E4F71C23BA5F6E8FD32BE62AC9538E397CDE8F2ECBE46FAA721242A
                                                                                                                                                                                                                                                                                            SHA-512:A04E6FD052D2D63A0737C83702C66A9AF834F9DF8423666508C42B3E1D8384300239C9DDACDC31C1E85140EB1193BCFAC209F218750B40342492FFCE6E9DA481
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`.........."......`........................@.................................sS....@.............................`................E...........,...............~.......................}......@4..........................@....................text...?_.......`.................. ..`.rdata......p.......d..............@..@.data....c.......0..................@....00cfg.......p......................@..@.tls................................@....voltbl.P...............................CPADinfo0...........................@....rsrc....E.......F..................@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\browser_assistant.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3291288
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.8236015092223115
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:28A21AFB4BDC543B4B0309BB78B8BA4A
                                                                                                                                                                                                                                                                                            SHA1:AB6230C0E1C2C12FC5C9B7A60EA5ADEF99E7783B
                                                                                                                                                                                                                                                                                            SHA-256:672AEB85A07EC1A25DBCF48B64D3BDE24DD0691C2BB27ED74A536776F63B5D27
                                                                                                                                                                                                                                                                                            SHA-512:806A3466DD4DE9BFCA6B13C20E69985DECFB8FFE5A31F785D649DAB249064FC4EC1FBBA9DDAEFC634D6E7AA355FEF73F511357C748043E407F979B150C159CB7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`..........".......'..........6$...........@...........................2......v2...@........................../.^...1./.T.....0.@.............2.......1......k/..................... j/.......-.............P./.....`./.@....................text.....'.......'................. ..`.rdata....... '.......'.............@..@.data...,n....0..2..../.............@....00cfg.......p0.......0.............@..@.rodata.......0.......0............. ..`.tls..........0.......0.............@....voltbl.\.....0.......0.................CPADinfo0.....0.......0.............@....rsrc...@.....0.......0.............@..@.reloc........1.......0.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\files_list

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):61
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.030896101301726
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2F070A8DDB1E4A5BC2137DBB2967E9A8
                                                                                                                                                                                                                                                                                            SHA1:F9F38DA409C2D4DFCE3471CF6621B7B81B797BF5
                                                                                                                                                                                                                                                                                            SHA-256:4C3722675F9E72C3ECE2A029DC8637CD8219CEB40B623D6DC75647314036AD3C
                                                                                                                                                                                                                                                                                            SHA-512:52FCB7870637F46D156D2F210E119A52B5B5226B9AEDE66ACF51160FBA45310D865DC4CCE1BD8A82156C414175DE49A5DCB527CF9F635F925D3C5603872CDD7C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:assistant_installer.exe..browser_assistant.exe..mojo_core.dll

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\mojo_core.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):990360
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.751997627821156
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7913D58432695A0DD61EE6B472FBDE99
                                                                                                                                                                                                                                                                                            SHA1:2F29F0B689539C03F16C1DB7DEBD216F8D71A110
                                                                                                                                                                                                                                                                                            SHA-256:789E08420078F7EAFBE22A28CD657313829E52F9A5133FD20D894A0AADFC0CD1
                                                                                                                                                                                                                                                                                            SHA-512:ECD2D61ED30F455746E7A70D719C9A10C85C861753BBBF9E478F6B5C6790465B1BE6951594222C5B5F5F7471E0A54EFEC8F66247F817E7AD97BB4E5839CC4326
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`.........."!.........F............................................................@A.........................?..t....?............................... ..0l...*.......................).......................B...............................text...|........................... ..`.rdata..(...........................@..@.data...,g.......,...`..............@....00cfg..............................@..@.tls................................@....voltbl..................................reloc..0l... ...n..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\b18f9256-d694-40d4-a40d-a655df2878ea.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1053
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.098379302759908
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6DC1ECB027FF90B72A080F6A61E06FA9
                                                                                                                                                                                                                                                                                            SHA1:A126C34F15C2B7DD2970C7A1B557E984A22F18F7
                                                                                                                                                                                                                                                                                            SHA-256:54EEA324A75C5740125332F66D8EAFF454772316165EB6558E88F5602C1874C8
                                                                                                                                                                                                                                                                                            SHA-512:E6338247B6EAD85CCD62DDBBB3538B706772D45624980843B856A9CFCD0D459F14AEA2643B90DDEF1F2867020B6D71DE832AEE4EB995D33DC13B73EED6A9EADC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"country":"US","features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote-features-guid":"af8f1523-0107-4b83-9331-8ecf81b0520e","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_medium=pb&utm_source=OFT&http_referrer=&query=/opera_gx/stable/edition/std-2/?utm_source=OFT%26utm_me

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\e70dd342-dbc5-4bde-99c5-c8d573c6ef89.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):265
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.93991336931762
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E2C2F2F491C26FB18BA5C6E43D8C4CDE
                                                                                                                                                                                                                                                                                            SHA1:F1BF54CABA806337525BB1640853E7D591749767
                                                                                                                                                                                                                                                                                            SHA-256:C9D9836FC35237606BC094775041EC724939A99741E26B35656E90790FC6A8E1
                                                                                                                                                                                                                                                                                            SHA-512:07D4FBC7ACE119CE02A0B69660734DA441928455AEC417FB6B92D47F4672DEC6126FF14291978DF442AA7C5F159C2198007F8B61382F8663609B8FAC88F58290
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_medium=pb&utm_source=OFT&http_referrer=&query=/opera_gx/stable/edition/std-2/?utm_source=OFT%26utm_medium=pb%26utm_campaign=ogx%26utm_content=ogxi_34420"}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\files_list

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):39
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.830148693165749
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:FE7F046D773FC1DE764E1BE70614BF20
                                                                                                                                                                                                                                                                                            SHA1:C2F16957953DEEB6DE1A12FA656AC84FCAA5B085
                                                                                                                                                                                                                                                                                            SHA-256:3D87AD3D7001FBE5D65682BF1111A73C4A1BA68B34C604C6BDE77C5DD8ADCC8E
                                                                                                                                                                                                                                                                                            SHA-512:405BC34A634007AF8159252D1E28AD3578BD6339C81B9DE97E022FD1420D0394488C09A36BD7E23BB38DF466AE2FA1B66420F97198DBD2099A161ABCDA121A03
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:resources/custom_partner_content.json..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\installer_prefs_include.json (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):265
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.93991336931762
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E2C2F2F491C26FB18BA5C6E43D8C4CDE
                                                                                                                                                                                                                                                                                            SHA1:F1BF54CABA806337525BB1640853E7D591749767
                                                                                                                                                                                                                                                                                            SHA-256:C9D9836FC35237606BC094775041EC724939A99741E26B35656E90790FC6A8E1
                                                                                                                                                                                                                                                                                            SHA-512:07D4FBC7ACE119CE02A0B69660734DA441928455AEC417FB6B92D47F4672DEC6126FF14291978DF442AA7C5F159C2198007F8B61382F8663609B8FAC88F58290
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_medium=pb&utm_source=OFT&http_referrer=&query=/opera_gx/stable/edition/std-2/?utm_source=OFT%26utm_medium=pb%26utm_campaign=ogx%26utm_content=ogxi_34420"}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\installer_prefs_include.json.backup

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1053
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.098379302759908
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6DC1ECB027FF90B72A080F6A61E06FA9
                                                                                                                                                                                                                                                                                            SHA1:A126C34F15C2B7DD2970C7A1B557E984A22F18F7
                                                                                                                                                                                                                                                                                            SHA-256:54EEA324A75C5740125332F66D8EAFF454772316165EB6558E88F5602C1874C8
                                                                                                                                                                                                                                                                                            SHA-512:E6338247B6EAD85CCD62DDBBB3538B706772D45624980843B856A9CFCD0D459F14AEA2643B90DDEF1F2867020B6D71DE832AEE4EB995D33DC13B73EED6A9EADC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"country":"US","features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote-features-guid":"af8f1523-0107-4b83-9331-8ecf81b0520e","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_medium=pb&utm_source=OFT&http_referrer=&query=/opera_gx/stable/edition/std-2/?utm_source=OFT%26utm_me

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\installer_prefs_include.json~RF3c777e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):265
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.93991336931762
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E2C2F2F491C26FB18BA5C6E43D8C4CDE
                                                                                                                                                                                                                                                                                            SHA1:F1BF54CABA806337525BB1640853E7D591749767
                                                                                                                                                                                                                                                                                            SHA-256:C9D9836FC35237606BC094775041EC724939A99741E26B35656E90790FC6A8E1
                                                                                                                                                                                                                                                                                            SHA-512:07D4FBC7ACE119CE02A0B69660734DA441928455AEC417FB6B92D47F4672DEC6126FF14291978DF442AA7C5F159C2198007F8B61382F8663609B8FAC88F58290
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_medium=pb&utm_source=OFT&http_referrer=&query=/opera_gx/stable/edition/std-2/?utm_source=OFT%26utm_medium=pb%26utm_campaign=ogx%26utm_content=ogxi_34420"}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\installer_prefs_include.json~RF3c778d.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):265
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.93991336931762
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E2C2F2F491C26FB18BA5C6E43D8C4CDE
                                                                                                                                                                                                                                                                                            SHA1:F1BF54CABA806337525BB1640853E7D591749767
                                                                                                                                                                                                                                                                                            SHA-256:C9D9836FC35237606BC094775041EC724939A99741E26B35656E90790FC6A8E1
                                                                                                                                                                                                                                                                                            SHA-512:07D4FBC7ACE119CE02A0B69660734DA441928455AEC417FB6B92D47F4672DEC6126FF14291978DF442AA7C5F159C2198007F8B61382F8663609B8FAC88F58290
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=ogx&utm_content=ogxi_34420&utm_medium=pb&utm_source=OFT&http_referrer=&query=/opera_gx/stable/edition/std-2/?utm_source=OFT%26utm_medium=pb%26utm_campaign=ogx%26utm_content=ogxi_34420"}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\opera_package

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):149541456
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.999978656099499
                                                                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5EBFCE7CAE88212CBDC767E833D6E731
                                                                                                                                                                                                                                                                                            SHA1:4EE6F93CDB198290E94B5CF6FB79CF27689EE0F8
                                                                                                                                                                                                                                                                                            SHA-256:D3C57AA7DE97F93900760B88B1CC50A7D676BA9D29C865BF5BEFE72936EABDD7
                                                                                                                                                                                                                                                                                            SHA-512:5FE3F8A3713DB951D5FB2B7269A149548F9634942254C201B72DC97D93E7E3826A35BD0075F3BF4D72E9DD9EECA4FDEAFF070B0A23A9BE7C9521473CA7EAF139
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(2S&lS=ulS=ulS=u'+>t`S=u'+8t.S=u..8tAS=u..9t.S=u..>tyS=u'+9tyS=u'+<teS=ulS<u.S=u..5t:S=u...umS=ulS.umS=u..?tmS=uRichlS=u........PE..L...4.if...............'..........................@..................................&....@..................................R..d........................).......&......................................@............................................text............................... ..`.rdata..............................@..@.data....A...`.......J..............@....rsrc................`..............@..@.reloc...&.......(...l..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\pref_default_overrides

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2
                                                                                                                                                                                                                                                                                            Entropy (8bit):1.0
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:99914B932BD37A50B983C5E7C90AE93B
                                                                                                                                                                                                                                                                                            SHA1:BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
                                                                                                                                                                                                                                                                                            SHA-256:44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
                                                                                                                                                                                                                                                                                            SHA-512:27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\resources\custom_partner_content.json (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):242304
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.028776242997077
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                                                                                                            SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                                                                                                            SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                                                                                                            SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_users": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\server_tracking_data

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (928), with no line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):928
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.668014177318632
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B36E602204FECBD921DEC6B2ABC420FB
                                                                                                                                                                                                                                                                                            SHA1:C50B1BA588A240ABD068F63FAD7959FA5B2AAE9D
                                                                                                                                                                                                                                                                                            SHA-256:82383FA339AAE8511CF63BCAF418BC206C99686AAF7DE6EBF968D6E534C416AB
                                                                                                                                                                                                                                                                                            SHA-512:A2BEBDDE759411453351A2163DBFD4F7A0505CE36146C435824F5ECE228BFC825EA226E1A738315494533738A7B34DEF997F2556D7A6DEF7CBA285A2DF969359
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ==

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6820248
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.170583543939228
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A910474AAD1EEA96921D359E1763D2FD
                                                                                                                                                                                                                                                                                            SHA1:8F663C05861CE93A1418607BD208C21DC7263237
                                                                                                                                                                                                                                                                                            SHA-256:5354A7FA4EF330546D79E1EA02C456084400D0B47D52AAA43B088340981F461E
                                                                                                                                                                                                                                                                                            SHA-512:8654F3C5EB98DD4097ED5367771F2F3487A4C90F95754CA39B8900AB52C2C78AB6F90DA339C1CCE06364CA242D49901A7EBBAC92CF14955E3A267EA988C194E4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.........."......b....c.....|.............@..........................@h.......h...@.................................p%..P.......(Xb...........g..)....h..6...".......................!......................P'...............................text....a.......b.................. ..`.rdata...............f..............@..@.data....5...P.......6..............@....tls.................T..............@....rsrc...(Xb......Zb..V..............@..@.reloc...6....h..8....g.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103711306.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1882)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):39454
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.346354793697792
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2950667817150A74B4C631CD27E1A644
                                                                                                                                                                                                                                                                                            SHA1:8D60EBADF7CEFCC0C7D7D4777116BFD515E039D6
                                                                                                                                                                                                                                                                                            SHA-256:3ECFAEFA0A9226C2C20E12507DC7482573102F7C4A7678614453656D9F157894
                                                                                                                                                                                                                                                                                            SHA-512:4B1E1A518CAF75E7E46ECFCA990D0FBB580F428C256AF4933866CB83121D12611D7D08FA9879DC597FB96B96A809C965C226A7C42782C40769DFF6CE96787BEB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:[1029/103711.306:INFO:installer_main.cc(475)] Opera GX installer starting - version 114.0.5282.123 Stable.[1029/103711.306:INFO:installer_main.cc(478)] Command line: "C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe" --silent --allusers=0 --server-tracking-blob=YzNjYzBkNzBjNDk4NTlkM2U3YTIzOTI2N2M2ZGIyMjU0OGQ2OWMxY2Y5YjZkMTY4MGI3OTJjMTc3ZDI3MGZkMjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInRpbWVzdGFtcCI6IjE3MzAyMTI2MjMuNTk2OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdpbjY0OyB4NjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoib2d4IiwiY29udGVudCI6Im9neGlfMzQ0MjAiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6Ik9GVCJ9LCJ1

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103713177.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1893)
                                                                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                                                                            Size (bytes):5415
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.7880608340361395
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:FD600240834A3956C504B1F9BF2DA46F
                                                                                                                                                                                                                                                                                            SHA1:A92FD439FCE8731B0C44606AC680DCC35E722474
                                                                                                                                                                                                                                                                                            SHA-256:ED3AD8CB9FCC7A550B03DE2527520B2ED405A7360D5F2E8F8A36FCD2584E9C63
                                                                                                                                                                                                                                                                                            SHA-512:551307AC9810E3293D4EFD5E0534ABDA864ED2986903D705650352C270C5B43A7B6A85EA55BDF4063DC951D6356DB6A4216C8ABF7FE684BC43A7787A3EF96245
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:[1029/103713.193:INFO:installer_main.cc(475)] Opera GX installer starting - version 114.0.5282.123 Stable.[1029/103713.193:INFO:installer_main.cc(478)] Command line: "C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241029103712" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYm

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241029103832254.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1838)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):4440
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.703339405802043
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:1D2936C7091A78DBE6B9589B789FA2F3
                                                                                                                                                                                                                                                                                            SHA1:5855B068F81BBF79E6C3D3D024E0A46C85B75494
                                                                                                                                                                                                                                                                                            SHA-256:673A319D6AC676F123871C87C0950875CBA047D9AFCECF9480F3314E1EE7B4E5
                                                                                                                                                                                                                                                                                            SHA-512:860FEA9764FB2FD991FB66C88CD59F3F2A957E77459771FD527178AF2A0D562778B43E295C0D86E949FA9C12773232F5F5810177A9207CC60572B423550933E0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:[1029/103832.254:INFO:installer_main.cc(475)] Opera GX installer starting - version 114.0.5282.123 Stable.[1029/103832.254:INFO:installer_main.cc(478)] Command line: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --backend --initial-pid=3928 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUy

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\5c16f908-8803-493a-908b-ed08911ebcb9.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 352 x 248, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):45209
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.991291218358247
                                                                                                                                                                                                                                                                                            Encrypted:true
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7C0F9CB42447ABDB164CB1AB132C9A66
                                                                                                                                                                                                                                                                                            SHA1:7CCA971E4ABB1D854C7DD00ED19E93921F4ED443
                                                                                                                                                                                                                                                                                            SHA-256:17D07AA532624E314E08F0143A8D55394BD7C78AE52F45AD11F67EC405AC6B0F
                                                                                                                                                                                                                                                                                            SHA-512:4291FDE8F2211F625FABF0529DA802C7AA2E7A36AAD64162EB747DF420023DB47FDA01EF18CE6943C1FD67D16CEF34F9426F1BF55B5EAFBEAB3B6BA4AE7A0367
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...`.........]A.....`IDATx...5..@.@Qi .........)C...3.]....C..K........@ .......@ .....@ .......@ .......@ .....@ .......@ .......@ .k&..@......@..... ..@..... ..@......@..... ..@..... ..@... ..@..... ..@..... ..@... ..@..A.....RQ...s.\...+......<A.U.c..@ ...@......A......h=3......[{1.d....g}.....!..i.....j.N..}..O...m.{.F ........q;..-s..qs.*.....CDP....x>fD|.~<.... x>..+...o.OF^G....}..Ju.'{...{q....8....e..?.~.....T....W.....e. @..HQ......)I....`?.<k^...\J.c....K.zl..q..).J.....G.....W.;.....;..../#I].My..-.L...&.T.......t...t..!..Z.I.....rp....d......M...{..@R3..F.1.B%..$.l.al....k-|..Cr....rd..e.B.@.-..Y,3`.. ..i.0IU.3#Q.;x@($yj.mj.......T....w/...P=4...Q.....yb.ws..].F..X...c.Y2..6f....+....1....nk.g.p.7m.]>.v .[I.V..)7.A......* ...6@PRV......d.e.!....gE..X...IA..0 ..Z.....VaQ.r....g..`*._.[+.nE...T...U..,E..tI..._...MK.T)G..i.@B..Icpw8.(...;.........c.z.%..Y..,.^.GR..!.(......J^.,..k.T.J.`..g..PUrp.UAyu.~......[./[#z6.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6820248
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.170583543939228
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A910474AAD1EEA96921D359E1763D2FD
                                                                                                                                                                                                                                                                                            SHA1:8F663C05861CE93A1418607BD208C21DC7263237
                                                                                                                                                                                                                                                                                            SHA-256:5354A7FA4EF330546D79E1EA02C456084400D0B47D52AAA43B088340981F461E
                                                                                                                                                                                                                                                                                            SHA-512:8654F3C5EB98DD4097ED5367771F2F3487A4C90F95754CA39B8900AB52C2C78AB6F90DA339C1CCE06364CA242D49901A7EBBAC92CF14955E3A267EA988C194E4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.........."......b....c.....|.............@..........................@h.......h...@.................................p%..P.......(Xb...........g..)....h..6...".......................!......................P'...............................text....a.......b.................. ..`.rdata...............f..............@..@.data....5...P.......6..............@....tls.................T..............@....rsrc...(Xb......Zb..V..............@..@.reloc...6....h..8....g.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3313792
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.961256672526251
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8A3BD58257B48475AE9B793F522E5759
                                                                                                                                                                                                                                                                                            SHA1:EB3F449084D1D7308CD8FD47B3EC47B2F19358DD
                                                                                                                                                                                                                                                                                            SHA-256:D390FD781223BF4062EFE2A642F74770D2E13963C1F481475F2933502B6E2EF0
                                                                                                                                                                                                                                                                                            SHA-512:1D67471E38F24C4F11A50FAD16BA93D19EC7E3478F4A8042822E87795A370AD409BDB6350C86A73FEDC04CB1B008E76F5F69ECA368B7F7C7CF1C9C383E028280
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....m...m...m..A....m..A....m...._m.....m.....m..A....m..A....m...m...m....\m....X..m...m0..m.....m..Rich.m..........PE..L....if...............'.....j....................@...................................3...@.................................H...d.......T0...........c2..,...@...1...C...............................C..@...............0............................text............................... ..`.rdata..z...........................@..@.data....K..........................@....rsrc...T0.......2..................@..@.reloc...1...@...2..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437108383928.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6287256
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.186042672427458
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:94A99783BF5A9AEB8A0C8ADCBB144AC8
                                                                                                                                                                                                                                                                                            SHA1:F5682606D1A3774A44D58A42391533899578897B
                                                                                                                                                                                                                                                                                            SHA-256:5D8ACD8032A3F3147B50E88DD1141312F9232F46EE0CB9487EFAE3C23545A0E9
                                                                                                                                                                                                                                                                                            SHA-512:F545D11B103B79A00F8118000A447B26F76520F9AE4C4E78542237EB11B931B98900F62065AE3FBFF747A79D6954D15A7CCB123B2ADCFC81DF71C17A6CF840A2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.........."!......6...)......1(.......................................a.......`...@A........................:.>.m.....>...... A.8............._..)....`....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data...@.... ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...8.... A......N?.............@..@.reloc.......`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437111626972.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6287256
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.186042672427458
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:94A99783BF5A9AEB8A0C8ADCBB144AC8
                                                                                                                                                                                                                                                                                            SHA1:F5682606D1A3774A44D58A42391533899578897B
                                                                                                                                                                                                                                                                                            SHA-256:5D8ACD8032A3F3147B50E88DD1141312F9232F46EE0CB9487EFAE3C23545A0E9
                                                                                                                                                                                                                                                                                            SHA-512:F545D11B103B79A00F8118000A447B26F76520F9AE4C4E78542237EB11B931B98900F62065AE3FBFF747A79D6954D15A7CCB123B2ADCFC81DF71C17A6CF840A2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.........."!......6...)......1(.......................................a.......`...@A........................:.>.m.....>...... A.8............._..)....`....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data...@.... ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...8.... A......N?.............@..@.reloc.......`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437117157164.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6287256
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.186042672427458
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:94A99783BF5A9AEB8A0C8ADCBB144AC8
                                                                                                                                                                                                                                                                                            SHA1:F5682606D1A3774A44D58A42391533899578897B
                                                                                                                                                                                                                                                                                            SHA-256:5D8ACD8032A3F3147B50E88DD1141312F9232F46EE0CB9487EFAE3C23545A0E9
                                                                                                                                                                                                                                                                                            SHA-512:F545D11B103B79A00F8118000A447B26F76520F9AE4C4E78542237EB11B931B98900F62065AE3FBFF747A79D6954D15A7CCB123B2ADCFC81DF71C17A6CF840A2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.........."!......6...)......1(.......................................a.......`...@A........................:.>.m.....>...... A.8............._..)....`....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data...@.... ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...8.... A......N?.............@..@.reloc.......`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Opera_installer_2410291437126772788.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6287256
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.186042672427458
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:94A99783BF5A9AEB8A0C8ADCBB144AC8
                                                                                                                                                                                                                                                                                            SHA1:F5682606D1A3774A44D58A42391533899578897B
                                                                                                                                                                                                                                                                                            SHA-256:5D8ACD8032A3F3147B50E88DD1141312F9232F46EE0CB9487EFAE3C23545A0E9
                                                                                                                                                                                                                                                                                            SHA-512:F545D11B103B79A00F8118000A447B26F76520F9AE4C4E78542237EB11B931B98900F62065AE3FBFF747A79D6954D15A7CCB123B2ADCFC81DF71C17A6CF840A2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.........."!......6...)......1(.......................................a.......`...@A........................:.>.m.....>...... A.8............._..)....`....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data...@.... ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...8.... A......N?.............@..@.reloc.......`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Opera_installer_241029143713033712.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6287256
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.186042672427458
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:94A99783BF5A9AEB8A0C8ADCBB144AC8
                                                                                                                                                                                                                                                                                            SHA1:F5682606D1A3774A44D58A42391533899578897B
                                                                                                                                                                                                                                                                                            SHA-256:5D8ACD8032A3F3147B50E88DD1141312F9232F46EE0CB9487EFAE3C23545A0E9
                                                                                                                                                                                                                                                                                            SHA-512:F545D11B103B79A00F8118000A447B26F76520F9AE4C4E78542237EB11B931B98900F62065AE3FBFF747A79D6954D15A7CCB123B2ADCFC81DF71C17A6CF840A2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g.........."!......6...)......1(.......................................a.......`...@A........................:.>.m.....>...... A.8............._..)....`....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data...@.... ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...8.... A......N?.............@..@.reloc.......`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Opera_installer_2410291438317856856.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7341976
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.955659935497318
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2ED93D2759FFEB0E4AC74FED8726F8EB
                                                                                                                                                                                                                                                                                            SHA1:7AA931FD4E4189EA2856FE5F1B7E6AF0DE97CFD8
                                                                                                                                                                                                                                                                                            SHA-256:78A00A6F22FA6F899A7534D3E3D38AAF1F659CB039A61D49F2E2A3617F268768
                                                                                                                                                                                                                                                                                            SHA-512:8205EF0522DD60B7E674461E8899903D6C1878EA3F50D31DD572136FAEA173D2212513C39F253309657146B9979B6FBF2D4ED8B65C631AA7CE0BFB6C81908CE0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....|C..D,.....Pn1.......................................q......p...`A........................................b.L.m....L.......R.8.... P.......o..)....q.\>..|GL.8...................PFL.(...P.C.@...........@.L.h...h.L.`....................text....{C......|C................. ..`.rdata........C.......C.............@..@.data....t....M.......M.............@....pdata....... P.......N.............@..@.gxfg...`3....R..4...lP.............@..@.retplne.....@R.......P..................rodata......PR.......P............. ..`.tls....q....`R.......P.............@...CPADinfo@....pR.......P.............@...LZMADEC.......R.......P............. ..`_RDATA........R.......P.............@..@malloc_h......R.......P............. ..`.rsrc...8.....R.......P.............@..@.reloc..\>....q..@....o.............@..B........................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\Opera_installer_2410291438320976684.dll

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7341976
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.955659935497318
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2ED93D2759FFEB0E4AC74FED8726F8EB
                                                                                                                                                                                                                                                                                            SHA1:7AA931FD4E4189EA2856FE5F1B7E6AF0DE97CFD8
                                                                                                                                                                                                                                                                                            SHA-256:78A00A6F22FA6F899A7534D3E3D38AAF1F659CB039A61D49F2E2A3617F268768
                                                                                                                                                                                                                                                                                            SHA-512:8205EF0522DD60B7E674461E8899903D6C1878EA3F50D31DD572136FAEA173D2212513C39F253309657146B9979B6FBF2D4ED8B65C631AA7CE0BFB6C81908CE0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......g.........." .....|C..D,.....Pn1.......................................q......p...`A........................................b.L.m....L.......R.8.... P.......o..)....q.\>..|GL.8...................PFL.(...P.C.@...........@.L.h...h.L.`....................text....{C......|C................. ..`.rdata........C.......C.............@..@.data....t....M.......M.............@....pdata....... P.......N.............@..@.gxfg...`3....R..4...lP.............@..@.retplne.....@R.......P..................rodata......PR.......P............. ..`.tls....q....`R.......P.............@...CPADinfo@....pR.......P.............@...LZMADEC.......R.......P............. ..`_RDATA........R.......P.............@..@malloc_h......R.......P............. ..`.rsrc...8.....R.......P.............@..@.reloc..\>....q..@....o.............@..B........................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\assistant_installer_20241029103753.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                                                                            Size (bytes):246
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.0154498614512235
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:97A0284B20F319FE7FC986D1A5AD1EE4
                                                                                                                                                                                                                                                                                            SHA1:D0E2CB8A53206FD9285505BE540BC90AEADB6F29
                                                                                                                                                                                                                                                                                            SHA-256:3DF07E85AFCB0CAEA1384849D11DD8EDF3E9CA6F868BF5ECC233C5DC0832F4F0
                                                                                                                                                                                                                                                                                            SHA-512:EEA19D43E5637970CB10ED106BA3E2149BC6AF0C40E4B8A7F85CE59411D2F004C2168A55F62FF2440CDB494C06469D5B32CA05C611994DB4A08F9D86870C3A9C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:[1029/103753.984:INFO:assistant_installer_main.cc(169)] Running assistant installer with command line "C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --version.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\e45b2c88-efe8-4116-9eec-3cee1871a5aa.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 1920 x 1080, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):518112
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.987594211798964
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:AE3260E9DC14CC37856E34EB0383934D
                                                                                                                                                                                                                                                                                            SHA1:6A30B17C526052CA3B701E03A903228D51FD43B3
                                                                                                                                                                                                                                                                                            SHA-256:1E67F06B15951D03148342CCD3A772A9B2F5A64EDBE68F1790C77032DEFE4CC3
                                                                                                                                                                                                                                                                                            SHA-512:ED950E70800175DE55A4B80FD69AE66FE5A6B49D8B266757E459252B73DC6E67ED45F67BF3CD57E538A66DD9DDDDC35052C50A29B24844ABF73FBA5BCC37D979
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR.......8.....B......IDATx.................................................................................................................................................................................................................................................................................................................f........._.AUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.=8........m.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.....a...(..I ...q.DAG..Py.ZwT.....{..u........

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\e862e7ec-0276-4a42-8e75-fdba48545f27.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):80475
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.90626316687261
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:700D0682E561D66985553EF7CFEB330E
                                                                                                                                                                                                                                                                                            SHA1:88179A93C5F5222594C2A1895A9861696A15CD86
                                                                                                                                                                                                                                                                                            SHA-256:1E2C80133CBB72CE7936BFA904CD3768883084EE2DD1C290A0B5C78E1E8E8771
                                                                                                                                                                                                                                                                                            SHA-512:EC728B874DFDD229081959F7C8ACF4B9CDFBD8423FA4A6AD2190AEB873CDC15B151DCD02A4DE3799B4A77BBC28C62B076D40B55F26F215BA910795BF29A2DBF4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.PNG........IHDR...8...8.......;.....sRGB.........IDAThC..o.E..owc.%..1.(..(.?..8.+mhh..D%..C8...._....h+.D.AJ.T.JZ)...B...I.'..f.^........Jfv.g....73%..<y..M.......5.3O....(.07,...........K.>..\.ry.....0t.....m.6..,..MMm..Y( ..g.....>....yr...,.0\......y...`..j.." .....*..)....-.]...+.....s!{.( 3W.y...*.\g3.-X....b....h1.x.!......H.3..........T..]X)!......./.`.r...<F..[B..c)...\^.m..y.d@.0.(..2.......=..0...'......L....h...t.LL..M...&...Q..e..p...''.vP..D......]..C)`.F..9...L..bf.........,!....I)xE.......@D;.....4..6.xW....T..9..@.(Z.".^.2.V.v...B.JK..y.......0.....znI....>...C.....*....=.yo...#..@..?J.K@.Q./iG....?...T...N.N..........,..m{V!...y......+..v..jh...w....o....i].h@.......u....9..w..s.}$..r.v.D.H/...:...U.\..D.r.B.....XB(.[*F..F..%.x../.....:.K.N...Ml.u............*...U*......-........MN.Pj.Q.E..g.lJH=Aw.....$7.5..T......u?Sj;.0.....,#...m..r......42..R..2....\W....#..![.......kX.J.....9`,.2Q.M.[..z......]...z.*......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera GX Browser .lnk

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Oct 29 13:38:32 2024, mtime=Tue Oct 29 13:38:32 2024, atime=Wed Oct 23 13:41:31 2024, length=1493400, window=hide
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1422
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.908851249711156
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B403406B202727736160745D10A66945
                                                                                                                                                                                                                                                                                            SHA1:48ECA54453289AADC1BD7BA7CE4788C5844A4EA8
                                                                                                                                                                                                                                                                                            SHA-256:7843CE028F124134538C0543B77C3D92DBB1915CC5FBC129A82B1C8BF64ACB85
                                                                                                                                                                                                                                                                                            SHA-512:CCD2872D522C4EEF9CE5B509E66026810923EF84F131E00AD344C78ABD6C28C1CA65EF220578ADBB960D62B99EEFFEE6F400C72E34A46D829D1DEADBE827BEDF
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:L..................F.... .....Q:.*....Q:.*......Y%............................:..DG..Yr?.D..U..k0.&...&.......$..S.....s..*....p:.*......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2]Y.t...........................^.A.p.p.D.a.t.a...B.P.1.....]Y.t..Local.<......EW<2]Y.t....[......................ac.L.o.c.a.l.....Z.1.....]Y.t..Programs..B......]Y.t]Y.t....`......................tv.P.r.o.g.r.a.m.s.....Z.1.....]Y.t..OPERAG~1..B......]Y.t]Y.t....q......................\..O.p.e.r.a. .G.X.....\.2.....WY0u .opera.exe.D......]Y.t]Y.t.....A.....................J.o.p.e.r.a...e.x.e.......j...............-.......i.............F......C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe..'.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.o.p.e.r.a...e.x.e.1.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........|....I.J.H..K..:...`.......X.......580913...........hT..CrF.f4... ...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera GX Browser .lnk

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Oct 29 13:38:32 2024, mtime=Tue Oct 29 13:38:32 2024, atime=Wed Oct 23 13:41:31 2024, length=1493400, window=hide
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1422
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.908851249711156
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B403406B202727736160745D10A66945
                                                                                                                                                                                                                                                                                            SHA1:48ECA54453289AADC1BD7BA7CE4788C5844A4EA8
                                                                                                                                                                                                                                                                                            SHA-256:7843CE028F124134538C0543B77C3D92DBB1915CC5FBC129A82B1C8BF64ACB85
                                                                                                                                                                                                                                                                                            SHA-512:CCD2872D522C4EEF9CE5B509E66026810923EF84F131E00AD344C78ABD6C28C1CA65EF220578ADBB960D62B99EEFFEE6F400C72E34A46D829D1DEADBE827BEDF
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:L..................F.... .....Q:.*....Q:.*......Y%............................:..DG..Yr?.D..U..k0.&...&.......$..S.....s..*....p:.*......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2]Y.t...........................^.A.p.p.D.a.t.a...B.P.1.....]Y.t..Local.<......EW<2]Y.t....[......................ac.L.o.c.a.l.....Z.1.....]Y.t..Programs..B......]Y.t]Y.t....`......................tv.P.r.o.g.r.a.m.s.....Z.1.....]Y.t..OPERAG~1..B......]Y.t]Y.t....q......................\..O.p.e.r.a. .G.X.....\.2.....WY0u .opera.exe.D......]Y.t]Y.t.....A.....................J.o.p.e.r.a...e.x.e.......j...............-.......i.............F......C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe..'.....\.....\.....\.....\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.o.p.e.r.a...e.x.e.1.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........|....I.J.H..K..:...`.......X.......580913...........hT..CrF.f4... ...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\01d82b45-0288-4c08-81b5-9717202e69f8.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3123)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3171
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.936812912038969
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0D3875A3980CABAE0C274413E0F20F82
                                                                                                                                                                                                                                                                                            SHA1:940B2D66186FE3EFB3E4FF76DE54876B191D4404
                                                                                                                                                                                                                                                                                            SHA-256:FB24B4C3F62E7F7802E4255E16379DCEDAA08B09F9C8BDEDF56A20D4882674AF
                                                                                                                                                                                                                                                                                            SHA-512:B8A3534A44638DBA0DE7144CE953C16EEE5F50AEFEDF1693522C3ED8B8F0F0B52D81C0244ACD4567F764BCA847CB02CABE98234A1730BCEFBCA36F53D35433EE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// zZ57bULngLPFUuuEzeJuFILyE1qfe1IISYOUl7s95p0=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"],"UserDecisions":{"address-bar-dropdown-a

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\03e0f0de-3b99-4edd-92be-0a6765df0c9b.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3083
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.487880600456643
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:662FEEE8E3015292FA9478AFE7DA4037
                                                                                                                                                                                                                                                                                            SHA1:E7349917DA8A69D13D051F64DDFF7756ED39566E
                                                                                                                                                                                                                                                                                            SHA-256:BD77A8EEE21184412F745F4FC49CA6A97EE3A6A6DC839541C14F67FD0275794C
                                                                                                                                                                                                                                                                                            SHA-512:3FA5753542AA55099801DD4E3B268D29921D4643121CECBFD71674115E40B7CA40DA9599FC4E6C903B2FF6BBFD4EAA64866778AF4387B7CAD5B9BA9F8FAC5443
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"ab_testing":{"uid":"ZmVmZGM2NWYtYzY3MS00MTgxLWFmYWYtYWU5ZmI3OTMyMjg0"},"autofill":{"ablation_seed":"7R2YBBYBw0s="},"browser":{"remote_flags":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote_flags_char_requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"remote_flags_guid":"af8f1523-0107-4b83-9331-8ecf81b0520e"},"browserjs":{"version":"1712230920"},"chars":{"list":[]},"component_updater":{"media_foundation_widevine

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\06325643-fe54-4cca-be66-7b25bf61286d.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.7411741819409166
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A67BA10BD0F642D50D0E19E3994A12B4
                                                                                                                                                                                                                                                                                            SHA1:83C444E89477D3509F52015C8D6D38DE29C09CE8
                                                                                                                                                                                                                                                                                            SHA-256:810DF065C0D6365F716010BD09F02702BFB3EE04E6A2D0A6CEA6E5D205B5AE56
                                                                                                                                                                                                                                                                                            SHA-512:F1F9CC748A267362A416101F27DFD06CAED6D68435D4A043C20ECBD06B1384FF813E69FFB7D566EC8C4F2CC787AAE49BB756B009A4406709229ADB2D86C2F7A4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// HVFr0JAObpNwVCRky0CDMKWCNqKs/kHa/CuLNHJyg3Y=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\08588b91-4dda-4cff-918e-b716b82241be.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (520)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):568
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.30012744206859
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8D306019890D48074E1A4421BAB03D4D
                                                                                                                                                                                                                                                                                            SHA1:E94A6D15E2765B94812B76D2A5D005AA2F6017AB
                                                                                                                                                                                                                                                                                            SHA-256:8D2DFF026DF4C0C20D115E75C567E8E01447C863D9B9AE5C0420C4E48CE8CFB6
                                                                                                                                                                                                                                                                                            SHA-512:96FE522DED913BDFACE94A0381A400B3924E76D935299935FA3C64E16E1131695AD1F98A4A7713D37A62C4646BB79442BFF352E9006A251D330DFEBD087AEF7F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// OhqJAhA/o36unuRiLuCb723zCu5CMAF33z8U3cGn514=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"TabAverageCount":2,"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}},"consent":{"statistics_collection_enabled":true,"user_experience_metrics_reporting_enabled":true},"current_context":{"application":{"version":"114.0.5282.123"}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\0d0ac546-d214-42a1-8ce0-e764847cd474.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\0f54d4ca-8da4-441a-89cb-86a3bad8c134.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):250
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.5194090265448486
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D04A78E0EABAD71315D2255D14098BD2
                                                                                                                                                                                                                                                                                            SHA1:558C02BF1EBB24B55C15F36992D685C43963293E
                                                                                                                                                                                                                                                                                            SHA-256:D0FF1C7B244F19C8729BFD9CBA71B3F7FDFED475B03E7F8A788D869890BEE5C2
                                                                                                                                                                                                                                                                                            SHA-512:A320563C2E7832E8A801C524ACAF72C660E5E73AF1BB2C5D23167C52D741B73E531A2B991808E2864CA6B098B7C214D1906D869402851A9B4A73FBFA72E3B4FE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// pWZUtaEwF6jPYjy85aDgOQKh1aSUTPrtOrzQiyGVvEM=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\115e1954-70a5-4c3a-8435-d1afc7b47c10.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (475)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):523
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.587809502091805
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:469D790B808D16DD2FD9FED0E5064741
                                                                                                                                                                                                                                                                                            SHA1:F7B1E24F2AE848F94DD2F52A09F3412E31298F7F
                                                                                                                                                                                                                                                                                            SHA-256:2B7156BAC2B86806C2C29A6EC9B32C5F47BCA7A0C0B8787919E3CF7BC5E843E5
                                                                                                                                                                                                                                                                                            SHA-512:667B9DE39AF2C8857B7C7C22CF88BBE443BC267B6DED392D2D71895C183713565B9A4287B7DF513C6F6CB270B62273008CF3B0FFF5185DEA2044F1520D5D4AD6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// T7mE8ciF1e7ALsYWvO+qPOK3CCwm10j6g9hFmTrPvJo=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":2},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\11d9d7b2-9965-4f40-a03c-92a77d55a685.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):221
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.519604572158065
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A599CAF9E906C236F8AA5283B1A0070F
                                                                                                                                                                                                                                                                                            SHA1:12263D0432F08D7DFEEB0C0BC5DC9B5626AA0F55
                                                                                                                                                                                                                                                                                            SHA-256:8D8C2775D1395AEC67136BE3E5459C726ECCF5BCE8BBBB4627360D990DB879B5
                                                                                                                                                                                                                                                                                            SHA-512:C2B4E7F4E40435A434BA8DE98C289432D4884B303CF6F66EA6434AE3D35CDE700B46341E585E93D9367F08BB048609ACB7743278533DE1AC0DE40EE89092C604
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// EfNziT2T3/fmE4bwqo+uhTORQQNVdQCOHsVtikByLsQ=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\177930ce-499e-4106-b559-57270033939d.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3157)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3205
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.944343054499978
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E245FC14B4631D4CAA6C432A21120A3E
                                                                                                                                                                                                                                                                                            SHA1:7C6D8135B92DB2FD235FD9377B7416621C9EED56
                                                                                                                                                                                                                                                                                            SHA-256:154604ED1A7652C23A91A1A2E1A49E1EE979BC73EC67F8940BF7C28DCFDB3C16
                                                                                                                                                                                                                                                                                            SHA-512:C724952C931054765D00D2F9A73F5A1DE81AD453073B272C93E3531F8E1954087BC386580168057E38BB9F8CA3452DFBC36ACF8E06D0A59DF569BBD3B9EECD2B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// yFaPwGBsBwMp5LtFBSQijLm5sMRm1KyusC79PLJHfY0=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveWebstoreExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"],"UserD

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\18fbab4c-b965-46c6-b20b-b495ec3c65d3.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (944)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):992
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.708553668132482
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:9EC12E0EAE37F7DC56B41DD63CB18085
                                                                                                                                                                                                                                                                                            SHA1:76950EEB708B83E0D1A700F2134167741BB2F4B6
                                                                                                                                                                                                                                                                                            SHA-256:28C2762FE57496819D31708E4D615EF9048B03F851E59A0FEE5E0FA8D5D0C194
                                                                                                                                                                                                                                                                                            SHA-512:6EC95A72928C0494E544C180E9E502794202577C162405AF9A41F8DA1ACBF86F23A85E75D6E62551125D5FD038980A5F4BC4F90412846D3262C247E23733066B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// DXIjBhGQ/JEVppZKCm4xqAuD53RJrVWAnxihGUkFvb0=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":2},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\19e50588-3b13-4ba0-8f19-9c39643b3ada.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.739949289780537
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7D7EDAE44022790E25ECA265A1486DF2
                                                                                                                                                                                                                                                                                            SHA1:F9FF2808A536A1C9BC65E3DEDEF0434CAB85CE05
                                                                                                                                                                                                                                                                                            SHA-256:D2B0957AD85B440E595B164CFD032D5A494C8B04A316AF476CF0552B8C848FAB
                                                                                                                                                                                                                                                                                            SHA-512:35599D5FE8670C76C0B49D4AA7A1989D7F7F8025D2927E5AF0BC834230BF8BF42CC37875F6619D144C5EB8A9B5F149D1021B2BE03E47EBA82C02363253E5B202
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// Q7DASOpYgQ+SsHZvUXzTLpFeSWVFCghh5kMBXxtijUY=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\1c03fdb6-4fd4-4163-9718-864360e4712a.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (2326)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2374
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.81572778994088
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4CA205BF51188DD7EC80CDEB121CDD31
                                                                                                                                                                                                                                                                                            SHA1:F3E8C099A03508A1F4CDC75CE784DCDBCA88FB33
                                                                                                                                                                                                                                                                                            SHA-256:896E9360ED041585371096FD24FD0836372325575B00F839439547FB4AB2D0C9
                                                                                                                                                                                                                                                                                            SHA-512:B62EB284B3A83444C9FC587E83F14D4358661D4D15D71194DD172B674267FD05AED5C4A23F18D0C20513858453A7F946368C29038DFE2E134229B8BBDAA02474
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// zyo054LFZi8GRiP5Dh+OmDKlKsOC91aOIIJObvONFQs=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"],"UserDecisions":{"address-bar-dropdown-autocompleted-domains":true,"ad

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\1c9e9dd0-1bf8-4f7c-a157-d7eb43b7e996.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3251)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3299
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.951744912469309
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:075448E3959A1457969875831CEE12CC
                                                                                                                                                                                                                                                                                            SHA1:70DA994D76473932E5B5424F22A95ACD5C93F165
                                                                                                                                                                                                                                                                                            SHA-256:884402A5CD167055676DFFD8F36261140A81ABBD4755FBC6D75B44CF5A1B745A
                                                                                                                                                                                                                                                                                            SHA-512:4401C8393E5C95CAF844167B3070C3DD2B003BA74D0FBB683FFEAEDFAE82FA002D3A87AB434C1E648C34A9918AFF47238CA1E391F56A2DCE8122FEBD78800DDC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// COAiH0ny+iDwQPJCyXDfbDOjQRAChNsDjTnkgeu6D0w=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"BlacklistedExtensionsInfo":{},"CVBlockedExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-att

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\35359814-8eaf-4639-9612-f13559df9798.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (654)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):702
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.641739681865217
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:204F9730886B61EFC924AA13A5DACFEE
                                                                                                                                                                                                                                                                                            SHA1:6945F52BDB2624C3464028954053D4834DB2D4B5
                                                                                                                                                                                                                                                                                            SHA-256:0431DEB2AFA6737A1597ADE5D2491B5F63AA46AE953F89AB6DCD917331E16026
                                                                                                                                                                                                                                                                                            SHA-512:0A79E4617F52869F3CD21E3841915F23A82B07A21EA6CA91E6B60F7DAA5EB577F07FB336F68F3B14E292AB4801EEFD0150D770CB35E26AAAF7CDB00485191A71
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// tRQTAYoSNufu2EHNgUqh/9YwNSLv602XUu92MkRN6aU=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":2},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\37f4e30c-9eff-4800-b50e-36da301b3e1c.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):274
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.4244395555623885
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7B9339BE4799B4D10C9C841D459E7B31
                                                                                                                                                                                                                                                                                            SHA1:B8521DFA187A722E1074FBA821E9D69F0DCA603D
                                                                                                                                                                                                                                                                                            SHA-256:AA7FE7403A6F34BDED596B7EC46854FAC8BE7362A424177C0A55E17ECDC4BD36
                                                                                                                                                                                                                                                                                            SHA-512:2D1F1E0594C1A09735D7CD405691264AA78271253E62A4F0D4BCE3C4C4C8E7141CEAECE2E3717A0466564576E6E04A3576501171E4DA80AFFBA4CF04E4F3521D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// z9CDis9pq94yxCvVwapp625EGInd2P5b1FO2TDsDWPg=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\380de5c4-b6b9-411e-bd98-e52b290273e1.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3378)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3426
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.961528094620517
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7E5801066F2E12AA9F5E417A5ACD0A22
                                                                                                                                                                                                                                                                                            SHA1:7D8D49B44BE5632DC8C17FFEF030FC769F1319CF
                                                                                                                                                                                                                                                                                            SHA-256:EA08F84833BC0929AD7AB425AF91670CEECC9C7EEF156A1A278BD6FDDFA1FFA0
                                                                                                                                                                                                                                                                                            SHA-512:A6261B7173ECC8BB361FCE8C567FFF98611B6F490DFE0030F2D998598A7F56F389343FF1FF367BB97C646FCA5F8A9D8F0715A5A003F96666BEA66221763800D3
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// TpS40DoV15Zs8KDujSjLJw/H1NGAJqUgzua51AGGYuI=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"BlacklistedExtensionsInfo":{},"CVBlockedExtensionsInfo":{},"CVUnverifiableExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggesti

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\38e7fb27-84d6-4aa6-8b9b-6782ccd80a19.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1043)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1091
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.724650774730865
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B8DE7F6B3E3150E3EA3C9E229E742B93
                                                                                                                                                                                                                                                                                            SHA1:45CCDFE801B1DD1EE97D918210FB82027753AC22
                                                                                                                                                                                                                                                                                            SHA-256:B150D0B2D5BB6208A0E6B06881D272816554047EF0E5CD0D613FD3922BBAC380
                                                                                                                                                                                                                                                                                            SHA-512:C9BF033D015D2EC5D365CF3EC55E40B996D2B8E6ABD813CD7EE72AF1794E16F06561EC1CA2B8C82EBB25CD9DFC52C57496375588F859262BDB8EBD7734E74DD3
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 9XgpZiyMc/1CVuCiJyhKfHXSF4zLB7QA0UvJ5gvU2BM=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingReq

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\3e265528-7665-4f25-90cf-d92b5a6fef46.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.732351536545735
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6FC4695358677928104C24436F7294B0
                                                                                                                                                                                                                                                                                            SHA1:B7A424F3AA4A10DD0CD8847AC54D5B1EC91402CA
                                                                                                                                                                                                                                                                                            SHA-256:0482156FE2E7671EC05D375DA2EFE72FB35F4199C7BDF934E8E094A1AD7B8040
                                                                                                                                                                                                                                                                                            SHA-512:00B4AE3A1C212397384DABC44C202358D11D5CBA6B6569C2A75ADA7A8C80F5E1112876FB354B1178272EA79387AFED30DE82FAD35D7C82BCEE767653D301B001
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// hKt6DXArtghH3hWYaPcrVCW5J2JSIue4FvnU4CH8joc=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\4cec3dfa-99cb-4e64-b533-7388c2011888.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1342)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1390
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.019936938087034
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2EE3C1C5187A4184FD2511EB601533C1
                                                                                                                                                                                                                                                                                            SHA1:B9D6A73FDCA52F365FD483CFDAB95AB9E42A0C12
                                                                                                                                                                                                                                                                                            SHA-256:D533DD27CFE55E6F70F5250CAB35108AFA3D46D8AA9D8230DE70ECDB085B2311
                                                                                                                                                                                                                                                                                            SHA-512:5FBA5BEE31BD142EE8298D802201D5733E0068EA2D65DB4AE53CDB90CE396C13CB0C2C6E765117D423D03CC0599152CEF29067459C17C56567BC8573EA38BF42
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// jHyq2nIA2E/6LEtTVE5R6gMZo6N7jMasYdcH9VYTxCA=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"]},"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\6102d12f-1a03-4fb2-9c89-fd57312b4c36.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.736407049003012
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:619AD68925C8735015C2370B110EE30C
                                                                                                                                                                                                                                                                                            SHA1:4216957E85EC76C51483771EE8AE7BBCFBE6D930
                                                                                                                                                                                                                                                                                            SHA-256:D85630AAA97B83F47F6408320DF8F627BB56440628BF4D68CC2F3CFB8D122D5E
                                                                                                                                                                                                                                                                                            SHA-512:A065CE2FAE67D972EEA1F5E3E9854212DB21D7D50222128D5399CACEE49C668C15881FB787370CA8C75C24067A7278CF76B98E335076D7035A33C52CEC193E85
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 9WspgRC3bnbckmygYQCLxvPeY+mIjOdmNZTPyKlNZL8=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\6e5f13b9-9984-4182-a1f6-6a2e2dac9212.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (2326)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2374
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.81572778994088
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4CA205BF51188DD7EC80CDEB121CDD31
                                                                                                                                                                                                                                                                                            SHA1:F3E8C099A03508A1F4CDC75CE784DCDBCA88FB33
                                                                                                                                                                                                                                                                                            SHA-256:896E9360ED041585371096FD24FD0836372325575B00F839439547FB4AB2D0C9
                                                                                                                                                                                                                                                                                            SHA-512:B62EB284B3A83444C9FC587E83F14D4358661D4D15D71194DD172B674267FD05AED5C4A23F18D0C20513858453A7F946368C29038DFE2E134229B8BBDAA02474
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// zyo054LFZi8GRiP5Dh+OmDKlKsOC91aOIIJObvONFQs=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"],"UserDecisions":{"address-bar-dropdown-autocompleted-domains":true,"ad

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\6fe258c4-04de-42fb-9f5a-d6d80c76a623.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):96216
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.573778003571561
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:527DBF517B493F46B1055B32225E257F
                                                                                                                                                                                                                                                                                            SHA1:25D06ABF506B83B4F0B8D8618312260BBA9BFF52
                                                                                                                                                                                                                                                                                            SHA-256:D3E4D8A67D149C4055C0BDC1E7CA6CF57E185652BF12F315565A20F56DE3B2BF
                                                                                                                                                                                                                                                                                            SHA-512:3689A48DD0F45A4477CF0F8E3659200168F107607FE43AFB9441D693C22B19E6B28FA6B7DC255A4F9DE821E54273B9AA26D80AD76055FF721D8CE5DA8E682D43
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"adblocker":{"whitelist_initialized":true,"whitelist_version":6},"bookmarks":{"partners":{"participating_user":true}},"extensions":{"opsettings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374686328536651","from_webstore":false,"granted_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"incognito_content_settings":[],"incognito_preferences":{},"is_pending_third_party_install":false,"last_update_time":"13374686328536651","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\733de6ec-2106-4be3-a4e8-7d2f1c2bafd5.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1232)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1280
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.720968045664352
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:84DBABD0D732657A3B937F6171E67509
                                                                                                                                                                                                                                                                                            SHA1:4D16A897919D7DFAE386D1E1EEE82EC7206E7FC6
                                                                                                                                                                                                                                                                                            SHA-256:E292E5B6FDBB07D960CF21F008851243F095334D8F02602C220867670E47C0CB
                                                                                                                                                                                                                                                                                            SHA-512:B3DF88A0A3AA0D74B42CBD6D46DBB06FC814F2F12958D977E3111E6E74162E0EE628CBF0E48A71ECF0BDF2314CD4B9DD612C148E27426EBB7E5F342C6996CC72
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// pJlaGUSZVh2BZZhOkUjw98tJGCjJrieawn8sIMya5Gg=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"I

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\7f46ceb9-9297-4b88-9004-984b5803d21f.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (380)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):428
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.525928820321167
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2F388108DDF9A2991261171D3234B750
                                                                                                                                                                                                                                                                                            SHA1:8C99036DE854C94EC19FC140E0B1BE5E2F78163F
                                                                                                                                                                                                                                                                                            SHA-256:9AF0D8245BE14E7D0DDEF8758002929FF48F20987951BE59C3D076BEDF5EDA57
                                                                                                                                                                                                                                                                                            SHA-512:F0253BA79E303A7140953BE222F1275A76A2AA0E4D9AB051B477DD32894E5788ED9E624FEF5672C352E1C7EBB1E939A5B5A2C32A3A9B3D67CB29242688641695
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4VmL4F0iYVRL8ZOFTCyZgPJpMo5/T6gjeXo7odlWh3o=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":2},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\836c601c-f1ed-4ba8-82db-7b724f27670f.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.7422895933653475
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:979FBB5DDC748EC01C4D11CFA5A6B0D6
                                                                                                                                                                                                                                                                                            SHA1:AAA5DEE4EDD8EF97C9D2ED224009EE74DB9D1EA7
                                                                                                                                                                                                                                                                                            SHA-256:4953CA63150E65B481ACEC41E515E2B5DE81350E8927065A59DFA01D3743BBCF
                                                                                                                                                                                                                                                                                            SHA-512:59A3C2FA1386B489C75CA94D90564409160D23FD781E986645AD1AF2DC9721AF1E1D21AAC2B62D0BD834A0AF348EB2322DDFE45DE83A7E8FD7B36ACC48A93495
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// jXDoKNp1YzzRv9NYw5CF5qiIF+xIUHVx8lhGS/sNpT4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\86f169bb-912b-4e26-864b-865cd0a5c7a7.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.734956115474216
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6F764CDB69FFD7AE3FA821A0777CC521
                                                                                                                                                                                                                                                                                            SHA1:F45B8BB812C76B3531620D649E4F8988FCC18B83
                                                                                                                                                                                                                                                                                            SHA-256:0B18FF9ED19AA14BCB54912D326251F0C1E4B392BCC81589A5E8669A35A8C22D
                                                                                                                                                                                                                                                                                            SHA-512:09270A29A27AA4412D0036C78FB68A529E60380F44F650F6F3A3852E325BD18649602D406B0E3D7E1E8F78AADF1F83F78EC417882E497ECB749DACEEECFDA419
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// VZYbAWuhBx2U3yNsyohQiA0zNwef1AURY9SmvNkM8u8=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\87d3703a-298a-4274-b383-c574af5df68b.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3285)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3333
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.955332513902423
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:9C866BE4167785822BFCAFCE7FA5CBE9
                                                                                                                                                                                                                                                                                            SHA1:81C8B8408021D1DD010B2AA3A081FBE42075856E
                                                                                                                                                                                                                                                                                            SHA-256:38C55EDFE2EF17AD831ABD97D339FB7A0CC674A917E5D5B0550274CC42A969EB
                                                                                                                                                                                                                                                                                            SHA-512:21766D909BDEED80068EA78835BAE11CA58620004128B831862573A719B11463B850AAAC7E5A6456487C2DC8C3BCEBC1AA00968C561F4C82C00B778F1131CE79
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// TLgK2VTOmQrhT/5riPSDKWxvXhLUyxMsNNuNEdki0Jw=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"BlacklistedExtensionsInfo":{},"CVBlockedExtensionsInfo":{},"CVUnverifiableExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggesti

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\8b6016df-b94b-4eb1-ab2f-170381df241b.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (568)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):616
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.621211082800802
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:92D9221A751FD5D989DF467B1DD16779
                                                                                                                                                                                                                                                                                            SHA1:DB82571097D7B405B3DE8B76B7DE654C7D470ADC
                                                                                                                                                                                                                                                                                            SHA-256:5EBA6AAEA808D1425C77079F0B52FCED9CEACF7317DA4010DE8B767A90475F2F
                                                                                                                                                                                                                                                                                            SHA-512:232E332D6D8A63DA842BCEB2D872F4E42007FD4CBA84ED52B18F14D552A7E9B997D799F6FD4B74CBCAC113EB8157677B25CF7AF16A60DCF7B775D914E8EB7FFC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// DnPRpWXKfhdMyd7MVBQhXhFfxRrhvctuhMH5Trj/zZc=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":2},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\99d351bf-b9e5-4f7c-9387-b63235ebc836.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.7358707196445
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:9BA140B2DD55E8363CD9C672BC96BBCB
                                                                                                                                                                                                                                                                                            SHA1:DC8A16CD830637260BD6892F6D70EDEAA11D085C
                                                                                                                                                                                                                                                                                            SHA-256:D8D7AF0EE7E10E46B8ABF22F1DBD1BC4F5CA265B6D65DBFA2830C42AEE62BB1D
                                                                                                                                                                                                                                                                                            SHA-512:7BF121022A077C48844D9579D63B08C6B7F70C6182DFBFA73F8E60E20354B7D2003F01894DE2C2A5DF223D01C7C2723E87BA7EFCFA6BEB8075FE9CCE7CBF3744
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// d2d+POFmozsyxefDbI8rb/nUI2CMxVz9SCWtIO30GCM=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\99feb41e-1f79-4735-96b6-50abb520a01e.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.738214955781318
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2E761C0DFE49B4D9EDCD3837B62C7E6B
                                                                                                                                                                                                                                                                                            SHA1:CCEFE67E8194FB7730930FA4C8294ABA50BB4B63
                                                                                                                                                                                                                                                                                            SHA-256:8382FEF73B8A71FC9F3FA0B635A48679A249F1824C4387FE083AD24F8384989D
                                                                                                                                                                                                                                                                                            SHA-512:28BE56E3C11D01AA8C9D867EA4330223613C6EEC753FA9E4A1640BFBB8561679A2166085B9D8F4830DA43122EB9C09BD8FBB29F46A753F69EEFE4E542412B3E5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// Gu5Ka7VPsSUIbIO7QjbgSbPYzhU6a1OJ0TCCh67ULJY=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\9deb55cb-2694-4572-a977-d0f1002ce86f.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3191)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3239
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.945147911499794
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CFBB9C65E44C59EF9496C08DF5C57430
                                                                                                                                                                                                                                                                                            SHA1:99258A2CEDF28E3E304612708E665B430A5968BE
                                                                                                                                                                                                                                                                                            SHA-256:3DE5AC493789C9DF0FDF1F4D474007529F6BD37FB14A3F0314D22F0E804F77DA
                                                                                                                                                                                                                                                                                            SHA-512:CECE81AC884AAF0C11DFD845755686D5EB7CC73D2BD9CE9487F84ABF689EF6130F249417A8D4DB2109AC4F6F67EA0081B39C1FD30A30FC58E292CDE1B79339DD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// h3DRRA4Y022K7yvqor9JIdxVi8t0ptdcSZLt96RcJ+k=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Affiliation Database

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 5, database pages 13, cookie 0x8, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):53248
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.3988860319126424
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:3A5A1B5681601D04C79F16F740244039
                                                                                                                                                                                                                                                                                            SHA1:C7C2F00345AD16077DFA5908C2D00A37025DEE30
                                                                                                                                                                                                                                                                                            SHA-256:5B038CEF519B60BB378CEAAD1EA0A101BE111C74613CBA63FC7F76625B4F72C7
                                                                                                                                                                                                                                                                                            SHA-512:E8CCB322E60FC7107482D809B0D2CBC81BF76517A2B55FC0B690AB57DA0177B88D7481B7645A200D085AF255BBD469A44289965F06C9D90A4EEC20EE8FA6AFBE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................v..........g.....e...$.y.........H....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\BrowseruserData

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2940
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.750881134945741
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:F5E000DB1DC5BE577D300465A326EC18
                                                                                                                                                                                                                                                                                            SHA1:F1B56155D366FAE5C51AB341D5B4961B26704324
                                                                                                                                                                                                                                                                                            SHA-256:80E8EAF7EE3F7C73DBB6F17155F43F116C65C431E68837EF9A5FBB76C14F86EE
                                                                                                                                                                                                                                                                                            SHA-512:3EDA522066A72E5D8B3F169E4C2588F302F240AE94547BDAE15008E0C1EA96E571E562676BD7B1217031CDA7F4D9EDDA3617D2E8D2515CC781F2783626788616
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XqUeAnNRLrvqWim4nVlZutTu71XnBcCh2H+nfBFFbs3k=....-......H6f72e82c-9a88-4b03-bb06-0dc1de3b7761.....d..........10............114.0.5282.123......R.........std-2..OPRGX.H4a82525b-4659-4b0c-b7b7-5f80354ae369....$......................s&...........................E..............................................................................L..........................Y..............)..............%.........................................................].0..&.4.......ZZ.F^........d...........H4a82525b-4659-4b0c-b7b7-5f80354ae369..x.... Blink.WebCodecs.lBrowser.Responsiveness.JankyIntervalsPerThirtySeconds2fBrowserRenderProcessHost.ChildCodeIntegrityFailures`BrowserRenderProcessHost.ChildLaunchFailureCodesXBrowserRenderProcessHost.ChildLaunchFailuresTBrowserRenderProcessHost.DisconnectedAliveVChildProcess.Crashed.UtilityProcessExitCode*ChildProcess.Crashed2(ChildProcess.Killed20CrashExitCodes.Extension.CrashExitCodes.Renderer.DataPack.LoadzEvent.Latenc

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\07942484fcf758f5_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):316
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.548814272771696
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2B1185017A12947FFD3B5F9652C95C69
                                                                                                                                                                                                                                                                                            SHA1:19C5DF932DD3B9815BBA670121860F85CC1A8463
                                                                                                                                                                                                                                                                                            SHA-256:47077988A95733FA0524496CEB84705C177BEBBFF9D38CDED6D17E37C7ECFABF
                                                                                                                                                                                                                                                                                            SHA-512:D55D70ACB53C305921B4B050D5F5C05603685CB7606B236D8AA2E75B23A46FBDA3AD2B5A182C5BF4712F8B0A76B90794585C7970C0EFCAE220927C99C2B4C4CB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..........U.8k...._keychrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/utils/bandwidth_monitor.js .chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.A..Eo..........................@.............].aF....M.h.A{24_s.&0BW...l.c....t./....................%...!qa<.>..B0M.. :.H"YC...I.A..Eo.......(.wL.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0a16005559f84252_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):312
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.440416915984533
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C7B9D93278EF4A1D022E0FBE2D9CEFA2
                                                                                                                                                                                                                                                                                            SHA1:80FE1F0159279C8F43CFE9B1525ED0EF8355A1C4
                                                                                                                                                                                                                                                                                            SHA-256:B78FCF0EF9C428C1EB9D93298CB7F401CCBCE413DE16A3C531E4318811C82B60
                                                                                                                                                                                                                                                                                            SHA-512:90DB091C5E678496C0A7CE86D83337497DD66F64DD58E6991CE9EC40752A406B2C8A82404A6BED4C361AB01C69BADA6476578C7B9F2A957EB64133ACDA0E8D87
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..........@..H...._keychrome-extension://ebongfbmlegepmkkdjlnlmdcmckedlal/touch_communication.js .chrome-extension://ebongfbmlegepmkkdjlnlmdcmckedlal/.A..Eo..........................@.............S....+=:O.p....@o.}^# ...Gt.c....t./.........*.........:...7.o.Q}...=..>F&.O#.v.N..A..Eo......d:..L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\1be8a98939ce4fb7_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):335
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.50737132153897
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:53A0DD0F95BFA5498B4C028374746F42
                                                                                                                                                                                                                                                                                            SHA1:045ADA9B98E33F11A02F6226265557081924A8B7
                                                                                                                                                                                                                                                                                            SHA-256:4FE56B47113E78CD65EB37144BCA396FBE59A0687FBDF3AC050132F0C22E7EB9
                                                                                                                                                                                                                                                                                            SHA-512:37820A79C2DB93344B449E3B50A75CEA5775D38CA85BDBB7E6D28AB60B55D7B9B63D1146876DC6A38C2AAC9055A1DCA01F66B8B3675297B4D72D000506939585
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..........Q=t7...._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/bookmarks_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@...........;"Y>..in.?..\..^=..y!..._.&./..d....t./....................W....N....TB...aA.g..r.?.P..A..Eo.......R9.L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\20a287387c5e678f_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):339
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.443614670304695
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:533AB4D53898CF4DE9EA7889EE56B46D
                                                                                                                                                                                                                                                                                            SHA1:38038C5B844691D94491F250E6840BDAB39D8634
                                                                                                                                                                                                                                                                                            SHA-256:AA2FAC93E9488BA3B70798CC5E3DE6DB75F2D6253D5830B88253112DF5AF6EEA
                                                                                                                                                                                                                                                                                            SHA-512:14153709673883B5DA640DD45EA6D4118E03F21A0F7A605D427F44C59FDEB971EB74CCCEF31651534B87443843948C2B4D29DCFDD6CC1788BD34D9E145D47B52
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m............~....._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/linkdiscovery_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@............S.+..h..Z.0..@7~..I.....f.9A.......t./.................O.&.LSJ.A@$.r-....p....b!.g..A..Eo.........L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\32611540fb9ed151_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):303
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.533531770875988
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4734F4E0251D7576203052CFE5F6E98D
                                                                                                                                                                                                                                                                                            SHA1:0A5189DFEFE6F44E26A7C90D5575D916F65F8B1E
                                                                                                                                                                                                                                                                                            SHA-256:D6FF5B530CECF97B6BCD984BB049E94C72314AA606FB6B7CD10FC0126A97F616
                                                                                                                                                                                                                                                                                            SHA-512:718B23D0507294A32492E512D139A0B06E5CEB758A96323BA14C63F4812230C931CC9968658C4B2B1F671450BA1C34FC401E7681E6BD892CA1A0C526C84FCFAD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m......{........._keychrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/background.js .chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.A..Eo..........................@............G]:..j.\!t.#<-/...OA...e'..W.......t./...................R6.....2._..G!S...m..T4;.....A..Eo........C.L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3470e4d337c902c4_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):330
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.570810692001627
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D130B36437D75B04EBF8CBBDE82E4107
                                                                                                                                                                                                                                                                                            SHA1:C84DAA7FCC53B10675C7165DF8D64BCEFBE5256D
                                                                                                                                                                                                                                                                                            SHA-256:D73C69C0BB976A3AE34AD35721DA945A7CC9306E11D02E45B963FE1ED0D970ED
                                                                                                                                                                                                                                                                                            SHA-512:B8855935405E569BDF6A19CFC912A666661B5112678628C764B5052489C04D8E4E1F6DA1F9FF9E5AADD54FF95F6BF24452DC8EBED1F382AFBD06B76A070839E2
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..........hT......_keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/mods_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@.................5O.0_..d0].@....T..........t./.................O.).'..%.o...J....P...^S.M3.[..A..Eo......E.U.L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3b3bfb0753fbd3ce_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):339
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.527153295884542
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:9D3F761F8685D4E3D93F1D9AF67204B3
                                                                                                                                                                                                                                                                                            SHA1:B7DA205DF6D1A2779E3E5EB8A3E13E4AB512FE0A
                                                                                                                                                                                                                                                                                            SHA-256:194CE6DE1AD8FAC81C2B908AFE9D25FC340BD99215A55D8838AB0EA391AFA886
                                                                                                                                                                                                                                                                                            SHA-512:E1F62509063687470201268B218FD93099476D610DCA5B6513A523DC95CB83F8465AD160CDCDB7BC4DE33195356F6CE851A4742B5A76E762DA5BF41AAE2D4325
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m................._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/personal_news_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@..............O.^\!..._.m..!`..>.ZQQ&....R....t./...................<~....a..}...m.a...y. ..T.r....A..Eo.......O.L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4115b7e9b499f6e4_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):309
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.4505766656011465
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5602CD68796B6E2B72C3AE0029DDE77A
                                                                                                                                                                                                                                                                                            SHA1:CB2DC2250B18E4B40353E4D23CE11C9A11D7BF88
                                                                                                                                                                                                                                                                                            SHA-256:50B6E4C86BF8E02F286B75EA4BCD9C5F0A931AA2F69BE80186A1D3FC3F6BE2D9
                                                                                                                                                                                                                                                                                            SHA-512:1C6CAA9DA9EE8787F0FF7532DB61F874AB09A267931769F05BC147DB16EFD0C460F3668DEE4E0375F9C27241197DE0997A535C1D84C97283F1EEBC93BED58632
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m.........../......_keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/gx/sounds_user.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@...........M.P......\.r.u...c........<Q.c....t./.......... ......-&......!...'.....u..w_...0.h..A..Eo.......#.lL.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4d23b4ed733a5827_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):335
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.46366410170947
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4ADD2F9A1A4C539DBFC2C56620F068B0
                                                                                                                                                                                                                                                                                            SHA1:9B4A6E07F03D864C41640867F838C75A70324EF1
                                                                                                                                                                                                                                                                                            SHA-256:DC198D5A1FCC06D0440CD182B9330FCC64E6D76D256C5001FFEBCFF1B3490C4D
                                                                                                                                                                                                                                                                                            SHA-512:882C24947025877BC5B99E44F5991BC0C04873761D3C58F4E9334C1896D8D62BEAB446020034DFB04ED69BCC4CAA8A3E827EEB3F780E5A7AE55D4E8D5E4AE54C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..........N.$F...._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/startpage_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@..............CI.p.cpui..1.+C...1&...GU.....t./.....................:..g.....W.._n.s..lN"5.....A..Eo.......W.L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\54846a74315ddbdf_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):304
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.453589514012108
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0CA361F81A4140C8EF625A751CCB2B81
                                                                                                                                                                                                                                                                                            SHA1:22A2DB84AA8949036097174A2B16F4F4ABE645F6
                                                                                                                                                                                                                                                                                            SHA-256:403E56C1E0EE83C0AB4C0BD8BB6CE6B184A70189BDFBDE4BD857074BE0BA3A50
                                                                                                                                                                                                                                                                                            SHA-512:E31D89F3CE5D285D2C121CCA999569EBA41BA81FF4FA46BB48AE6E81D87A25B41A308082452AC7716A3B97AA5592FE7806B4A66620809DC4022D61C86438F55B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m......|...v.*....._keychrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/utils/utils.js .chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.A..Eo..........................@.............J.8.?FjZ@.g. /ic.?k.M..y.3......t./..................D...[o....^gC1.bM]1#.....c.I.d..A..Eo.........yL.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\aa2493ab490d6c2d_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):333
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.497443988491951
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D6D93AFF352E51294AA49C352732968F
                                                                                                                                                                                                                                                                                            SHA1:4AC09747286A860ABDD76343A4DD63E6A5D79527
                                                                                                                                                                                                                                                                                            SHA-256:C140931ED6B8B97D5DB3227A25C9DBF9E05EDF11A5A88769669254F1017F57A4
                                                                                                                                                                                                                                                                                            SHA-512:5B0BD905F3C89ABC9F9C4C42B7D8FF8BE0869289402957CE77B8F9E3005202016EFBBEF61B802E8E94ED3CF6DFB443E5A9F1F52C4AF450798BEE65301F3880E0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m................._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/browser_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@.............f...QDl....nr..+!G.A.3..6.........t./...........................W..b.c....&)#....R..A..Eo........kL.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\bf5defd3c9899da8_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):310
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.548153640435475
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7B147683C27F3343DB1420A6596B4400
                                                                                                                                                                                                                                                                                            SHA1:55F9C9A1BE0EE003FFD6C37A238C44A27DBC5B9F
                                                                                                                                                                                                                                                                                            SHA-256:410C57A27D1C92622E36FE23177E9397872989901DB6BD6E21A288553D9BEF6D
                                                                                                                                                                                                                                                                                            SHA-512:56C596C0086432854C0763E321115440B4A7A673A2B99BF3F769E9D70B7890F448E1CBD487B3504E54D1FCF5EF9871208789B9AFBF3754CECB9E49BC1689EB05
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m.................._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/background_worker.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@.............-H....6.OaWBjqrT.3..>l.5...=1.....t./.................lh=.....7.....Y*<..I{.C|.......A..Eo......yS..L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\c7f4accc0246aad1_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):336
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.460399086651644
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:AE3A8D6E5B4290C8DE4683124D942C8B
                                                                                                                                                                                                                                                                                            SHA1:865FA53C636D6C36E5C65DCA66ACAA4A93023AE8
                                                                                                                                                                                                                                                                                            SHA-256:E83F058667B164F0C2B815258452F1BB8B8266261636AF1AE2A845319B9381E7
                                                                                                                                                                                                                                                                                            SHA-512:BFE5B2F6BE48D62C94EA473DDEAF117E5C41FFEA402ECD1F9343AFC112A6470F73E358B903AFA38D6FE53C97FF590230FAA867AEB5BD5152CC8B4614741C6590
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..........;.La...._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/assistance_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@...........<k.-......].q......&.[9.<O.)N.0....t./.................zf...:..+k-.....S..2...+.y..X.]0.A..Eo......rQ.L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\cad8c8308e37327d_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):305
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.501248313303386
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7AEE09966DCBBFAE978E4118EEA87EB1
                                                                                                                                                                                                                                                                                            SHA1:AC27AD3E71E97E8B4005AF1E2EFF08B525BA3B87
                                                                                                                                                                                                                                                                                            SHA-256:9F31724FF9530FBFA7F5E4D823D86F88CD9A986B09427179DEACAC092DF0A0B5
                                                                                                                                                                                                                                                                                            SHA-512:0C7BE9DB7F31752F44721A825D66D4FB90E545024D708D57C640FAC7CEE451BF71B56CF09CEAFA2FBBE82BC8E5FFB05D8A568F9958A19C063CA6BCC6E6FE6A24
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m......}...X.X....._keychrome-extension://ebongfbmlegepmkkdjlnlmdcmckedlal/base64js.min.js .chrome-extension://ebongfbmlegepmkkdjlnlmdcmckedlal/.A..Eo..........................@...............T..v....6...~.']b.G#X...]Cv.....t./...................;......X.@.....(x..i)A.&.~n.A..Eo......]...L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\ead2fae3022c2844_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):306
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.576373729858009
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:56651EDB19D77C98373AD9F5C4C78C95
                                                                                                                                                                                                                                                                                            SHA1:80A56C964ACBF2E733ADA81D375887EA8E9BCAC6
                                                                                                                                                                                                                                                                                            SHA-256:89E2B148B08BA0D56D52ED633B7F9D435EE7464F05528382F4023FE5E99DDF34
                                                                                                                                                                                                                                                                                            SHA-512:593D992E61A44B994F59DFB20ADD59B9B602BA8EC6174C0B11D0A94A5E6C84BC643233FBCE2A015487AC601C9A2C5340DA4B17A12B5C8CF76159BEB75B693D46
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m......~....S......_keychrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/utils/storage.js .chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.A..Eo..........................@.................>6^`.W.....p"....HF..n.h....t./.................tR...Hf....._7.....WXT........n.A..Eo......r.M.L.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\ec9b8b2e10e0e6d1_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):326
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.512040930876939
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B9CDBFA9B87CB3497962E535BD013F7C
                                                                                                                                                                                                                                                                                            SHA1:B64982712ACA1BB2C3B3FF124C4A4741023ECA01
                                                                                                                                                                                                                                                                                            SHA-256:45367356F9224FD53E404067E0CE7D8AA85467C2393F78ED5C93EF9B32B34ABF
                                                                                                                                                                                                                                                                                            SHA-512:983A94DE1D47B9E6672DB50F80022430DDDC06C3904E6EEA5A1BEB6E8068B8ED672D1229C2D996915311FA51887C7DFF2A09CFA48E759A3C8E2A7DA557B37731
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m.................._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/background_color/background_color.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@..............n..\7..d......UB.....F.t......t./.................:^T..'.k.2R.M.-.*-G...[.........A..Eo.......v.ML.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):24
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                                                            SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                                                            SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                                                            SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\index-dir\temp-index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):48
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4D109A144D33EFB56C9810DA7093794B
                                                                                                                                                                                                                                                                                            SHA1:1552A5A6EA1D84844F7CA2B77289B504D1166654
                                                                                                                                                                                                                                                                                            SHA-256:99A466FE6C2A5A405C9901CFBC6D58F53BAB70D0F8245FF742FDBE84B194F961
                                                                                                                                                                                                                                                                                            SHA-512:BD5A632C1E79D2FB1A55272C990128C55F914060A28A21D1301DBFBE201B7ADE50ECCBDB122A98704542262FC4CEC7614FD6FF95780DB3D1930F155B19C70D7A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:(...b...oy retne........................N...4./.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):48
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4D109A144D33EFB56C9810DA7093794B
                                                                                                                                                                                                                                                                                            SHA1:1552A5A6EA1D84844F7CA2B77289B504D1166654
                                                                                                                                                                                                                                                                                            SHA-256:99A466FE6C2A5A405C9901CFBC6D58F53BAB70D0F8245FF742FDBE84B194F961
                                                                                                                                                                                                                                                                                            SHA-512:BD5A632C1E79D2FB1A55272C990128C55F914060A28A21D1301DBFBE201B7ADE50ECCBDB122A98704542262FC4CEC7614FD6FF95780DB3D1930F155B19C70D7A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:(...b...oy retne........................N...4./.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\wasm\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):24
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                                                            SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                                                            SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                                                            SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):48
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4D109A144D33EFB56C9810DA7093794B
                                                                                                                                                                                                                                                                                            SHA1:1552A5A6EA1D84844F7CA2B77289B504D1166654
                                                                                                                                                                                                                                                                                            SHA-256:99A466FE6C2A5A405C9901CFBC6D58F53BAB70D0F8245FF742FDBE84B194F961
                                                                                                                                                                                                                                                                                            SHA-512:BD5A632C1E79D2FB1A55272C990128C55F914060A28A21D1301DBFBE201B7ADE50ECCBDB122A98704542262FC4CEC7614FD6FF95780DB3D1930F155B19C70D7A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:(...b...oy retne........................N...4./.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):48
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4D109A144D33EFB56C9810DA7093794B
                                                                                                                                                                                                                                                                                            SHA1:1552A5A6EA1D84844F7CA2B77289B504D1166654
                                                                                                                                                                                                                                                                                            SHA-256:99A466FE6C2A5A405C9901CFBC6D58F53BAB70D0F8245FF742FDBE84B194F961
                                                                                                                                                                                                                                                                                            SHA-512:BD5A632C1E79D2FB1A55272C990128C55F914060A28A21D1301DBFBE201B7ADE50ECCBDB122A98704542262FC4CEC7614FD6FF95780DB3D1930F155B19C70D7A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:(...b...oy retne........................N...4./.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                                                                            Size (bytes):40
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.3454618442383204
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:9CD7DF5D60DAC61B3DBD51101D65A8C3
                                                                                                                                                                                                                                                                                            SHA1:0D0138D34385FBBA94E920FA716141B446BDEC8D
                                                                                                                                                                                                                                                                                            SHA-256:417BDF62E25AC01D54C55DE289010AC415DF3B1209183E3BC44AAEACADD17075
                                                                                                                                                                                                                                                                                            SHA-512:801F100414B03D8E457CD4332987211C2EB24007F45BC121BCB8AACA2C5F85768B4B39925016B8C7354214CEE9F13CA1BEAACAF6C302511A575C75C422E17C61
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:sdPC...........................C..w..2t.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DIPS

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 1, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):36864
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.3925684129129412
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:82BA1D78A605C85950E9D1DD9ED5F239
                                                                                                                                                                                                                                                                                            SHA1:C68E1F4C6536F0312B4A342A4220DAC705CBEEEB
                                                                                                                                                                                                                                                                                            SHA-256:C0CFE8FBF3C3307389E10B2A9B7F7AB98F06841A0B3B35827C48DAA498255F95
                                                                                                                                                                                                                                                                                            SHA-512:442A346B0B5AE0B81447D8A3856AA893C2CB5BF0ED5D5E5381B326A368C8DA8E959D6628983C586811B6F6A331D23EC7F5D94486BE9C75FB1CFA7152F7907EAD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................v..........g.....:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\data_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\data_1

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\data_2

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\data_3

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:9F26C72F1DCE734DAA054ADD350D4372
                                                                                                                                                                                                                                                                                            SHA1:84CA4A53CC2898F7AF154AC2496E4F055BA9B1D4
                                                                                                                                                                                                                                                                                            SHA-256:21A6EB3BFE3B69D46C8848E29C6784EFC178A3BBC0C14AE76CD4C34968B85364
                                                                                                                                                                                                                                                                                            SHA-512:8C9EEB473D51B159353C9ADB804DF8F7ACC78ADD73C3638297D208D71FF3342E76A8712472C2B23EAA6A2443E2B282CAC2CB8F2C95F698C82F82D05763D318C7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................1O..4./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\data_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\data_1

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\data_2

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\data_3

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:229BC1F09A8E7275E2D8C374DE1AA4D6
                                                                                                                                                                                                                                                                                            SHA1:92AD6FBA0CE68CCA471133C00F929988A15A8097
                                                                                                                                                                                                                                                                                            SHA-256:748054C28A3A656509D222CE9E29893A485046A14B2480B823101AEB61EB7C4F
                                                                                                                                                                                                                                                                                            SHA-512:5F3FF9F634EA41E82F421CF3120A2A3F6E863D4BE376B20C13E1555E9F3A0AC3399817D87761871CE97BBC51531610C133E558836447F3031ECC5B5B609B9505
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............................................4./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):684
                                                                                                                                                                                                                                                                                            Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:F93B6A29284B7E38DFD05AF480D25AB7
                                                                                                                                                                                                                                                                                            SHA1:CDE3C88C5DD5D4E617E8F8157C03D66D730953F1
                                                                                                                                                                                                                                                                                            SHA-256:EBF65D839A9C2A53AB503763D44C3A0363D3387FAF4F947B5959463833C3B75A
                                                                                                                                                                                                                                                                                            SHA-512:E2148554C1B5C2B97175E5ADE1FE82B5A08311CE9D736907AC299F99C3580A99458D7FEFC894F4BADBA5921DFDA84F61117E1AE3E57B0063F127AACA6563E099
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):287
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.2118651305586035
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CF2E9AA571E706DC85861F32AB901C7E
                                                                                                                                                                                                                                                                                            SHA1:ACDF1248D04507ED4E73AE66196B5025C1313061
                                                                                                                                                                                                                                                                                            SHA-256:4DB118136FF40DB4F6E626557EBB74AAE24C8D4771939B0B959955C159640835
                                                                                                                                                                                                                                                                                            SHA-512:1CE75FD5738DA4DC95888442E9464C1818A5815DE862507437F246056A73C29CFD30E33C5AA51C3BFF3E56FC3EE4FE1C8489671898DDA6F2688F5CF4516F015B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:48.542 12d8 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules since it was missing..2024/10/29-10:38:48.675 12d8 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):756
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.4349061360960143
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:78D8E52D603CF7314C2D09DBD20ECEED
                                                                                                                                                                                                                                                                                            SHA1:2A7049977ABBD795E4599D7834B1C2A3481E9FFE
                                                                                                                                                                                                                                                                                            SHA-256:F7ADD3FF1F1746E7752FFDD0596F0E256197B1F51CC43B26AB4A3633EFCF67F3
                                                                                                                                                                                                                                                                                            SHA-512:A01C97A383DACD4E8EA443ED49452871F0F1B6FFF7C51FD9B3439B58B05E51C76E84F561B5CD5D5A1335483154476998D39F6E9D0C4742F5007041DB4CA213AA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............)..tA...............0ffeocbomcpokpmjkkloomhnflpjmkjpi.dynamic_scripts.[]

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):291
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.193221802185748
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B23051236335EC351FA547A50EF69BBE
                                                                                                                                                                                                                                                                                            SHA1:DF0424C8F7262A579450B66BDB52B5DE06B21759
                                                                                                                                                                                                                                                                                            SHA-256:00EC18C4FF6D73A45BA91FEB88910C993E6CE0618CE7962F1DB9FD8B97536E06
                                                                                                                                                                                                                                                                                            SHA-512:C4FA915DEE9C9C57D61C32C0F87186DAD736888DC62D25C5835A22B9C1B18E94895954F3A493D049AF9C8CC436054ABAA85E8B1EB8C5A836F4537A0FE1B88A9C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:48.679 12d8 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts since it was missing..2024/10/29-10:38:48.697 12d8 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2052
                                                                                                                                                                                                                                                                                            Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:17CF91CEBC20145AF217073787DD7069
                                                                                                                                                                                                                                                                                            SHA1:F172C673BB915B674D2E48ED320A45AAD1051479
                                                                                                                                                                                                                                                                                            SHA-256:F7CC9EE8B5B8B62540399BE882A30CE64399B68082AE6954D6AF12F64008BB31
                                                                                                                                                                                                                                                                                            SHA-512:7F53284F042A075400D81CABB00E7F25D1B828BD9382F8CF2B5DCF38511F11CDEE9A59740025E06C30E2D7EAAA3473BCB7722EA591666FE9BAEA9BD6FD903F58
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):287
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.167565696226108
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:01ABA6E20936327BF580B7D366242A5A
                                                                                                                                                                                                                                                                                            SHA1:01D8EFBA037988065EB4A3A98AD54CA245E6F2A7
                                                                                                                                                                                                                                                                                            SHA-256:B8312222C1B28DCB5C8F98B8E1350811D3722D3449AECB20C34624C12584855B
                                                                                                                                                                                                                                                                                            SHA-512:CCCCD6EB4335859B0C8967DD3E6F199E3144097FB85FDDF4EFC579CA39CDA774CFC2A9BDC679E10D6B58249E8912192FE9E2904688B7E340BA773656CA1532CB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:57.050 11d4 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State since it was missing..2024/10/29-10:38:57.066 11d4 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Favicons

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 2, database pages 19, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):38912
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.862678463615521
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C435F3D0C15BF6685D48ACD3A5BCE536
                                                                                                                                                                                                                                                                                            SHA1:0CCD5F8272734945F47DAC99ACA8184FBCA7041B
                                                                                                                                                                                                                                                                                            SHA-256:94EAA0C58EBC40B7532D79D1AC9F5EF245BB6756A09A973148A37ACEB04E185A
                                                                                                                                                                                                                                                                                            SHA-512:3AED15C1417EB37A49E4FB4C08FE12DEF476BF3E7698E39290F88CDDF77B4B8006754A34AF87956E16B23938716389BD9628E9B6A4F5DFE307AEE97D9873D112
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................v..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Favicons-journal

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16960
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.2925020597578065
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D7C07E99ED7EDC3C9549E46BB49F4D9C
                                                                                                                                                                                                                                                                                            SHA1:A7A51D3814ACCB030AB354A86BD98245B10FC41D
                                                                                                                                                                                                                                                                                            SHA-256:FE25A1E739158C69D8AB8E5829F2E412A0A45DBAAB15058239916986B39B121F
                                                                                                                                                                                                                                                                                            SHA-512:B0874D08D348260FC8DF28101220B662E59E0E8B2749A801629904D07C920120D08501FA315ADE49257A951481E1008C466B6ACF5DAB8F6E2DACB668EA698D1D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............t.U....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j.M.......c...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\data_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\data_1

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\data_2

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\data_3

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:685A35A1BC9610AEA36D5A655DA1561A
                                                                                                                                                                                                                                                                                            SHA1:B4DF1EF3AB712CB10D4A73998B41BF94E5596BE6
                                                                                                                                                                                                                                                                                            SHA-256:5126E717731B56FF0265BF69A168E90784F037CB6511838DDF81AB96438C6D2D
                                                                                                                                                                                                                                                                                            SHA-512:7073743FB1529491B3F3E127805D08EA789DA75EC4AAAA7293ECD82C11ABCABFEA378DF5BFC6A2E476B8375AEBEA2D7D8614F5E88824F8A1207C2DCC08FBF783
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........................................w..4./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_1

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_2

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_3

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                                                                                                                            Entropy (8bit):9.47693366977411E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:44305A6A6C114608D9D44C942C6BEC47
                                                                                                                                                                                                                                                                                            SHA1:9E07308C65CF4D013BF1E0F327A022EBE086B24F
                                                                                                                                                                                                                                                                                            SHA-256:749A5B3848CCBF599DEDEB95A37BC207FE858C24724DE2B3B30E9C082672A854
                                                                                                                                                                                                                                                                                            SHA-512:212E54332C908731D03E3837AAF24C1310F168745F39C4176599756A1CFEDAD0D3D93B67867FE28E4A95C1E9AE07AD617D9FC7B70CE622610D720220AB4681A7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............................................4./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_1

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_2

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_3

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:175CE1F77ECEAFFB2B12326051B8F32F
                                                                                                                                                                                                                                                                                            SHA1:1EB6C7A1D4D04FE75DEA8A5DDD0CBBBB671B7CBA
                                                                                                                                                                                                                                                                                            SHA-256:3C884C3C604BBFDB705AB42094C794D76AD31B546576B6CC2F37C2EA0A2AE470
                                                                                                                                                                                                                                                                                            SHA-512:2BBCF81720243B65D95455A3CD29AD89E98EDAC608E11F085E3F2F45D10A081E00C55B7C82727529CA4537684CFB83C5AFB2E97B228CF84D476F72F86EE888C6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................*...4./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\History

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 1, database pages 40, cookie 0x21, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):163840
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.5637005071085429
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B8D7D6AFE2D6ADAFCAF6B34E49EB6767
                                                                                                                                                                                                                                                                                            SHA1:D8582F59269234484370A90B76AD0DE5A5A6798F
                                                                                                                                                                                                                                                                                            SHA-256:EFC89D42E8BA3A25BC4B09ED1507C8AF6FD200C7570F57E55C5C4D8EC9293AAE
                                                                                                                                                                                                                                                                                            SHA-512:86567CAFADF3ABC97528B0003E64CE3B2A55BF6440788DE8BC53ECF3EABCBCD36E18741A62482CF3436AA064D3CAA6BD8375A72ACD503B7AA5B7F4AB23CBE8D7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......(...........!......................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\History-journal

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):37448
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.02597655684596956
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:04F2A7A92686C9761102EE92E56942AE
                                                                                                                                                                                                                                                                                            SHA1:F9DBAB5E26CE377FABAFD44201FD0EE1B91AC2F8
                                                                                                                                                                                                                                                                                            SHA-256:DFA3C9CFAECF7A56D59E56903FCF3AFB07BDD05DBC021E82E694D23041150C8F
                                                                                                                                                                                                                                                                                            SHA-512:4CA37CA002FB1B2EB44D388E5A1DE5A10B84D5A2226DA0BCE5260968643E8732C93B92DF384548147BDE4B41B3A10A15FC99BA693144A3D6F693D961AFE169BE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............!.Y&...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):974
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.667612048203854
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:2FF78A3372ED29F77CB7854BA49F2F58
                                                                                                                                                                                                                                                                                            SHA1:70409F29A7E289E2B7A2A9D20E66424F93E81D34
                                                                                                                                                                                                                                                                                            SHA-256:EC47B9A0FED1D45F16D83EBEE8CE623D695170488992152693FACDD98FEA3C3F
                                                                                                                                                                                                                                                                                            SHA-512:911C3C56B83275CB855E40DF2A3263337A8CED7EF7D2F04B1BDFD24A700C6C1A11871136CE99E9870AC5C9709BC79CDE231D8ADFFDA84129711DD54D97942132
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:. ......................2.......".....................................!.sj........................?.......c.h.r.o.m.e._.s.t.a.r.t.p.a.g.e._.0.@.1..g.x.-.t.i.l.e.s.....................c..L.............................2.........gx-tiles......2..........................................................2....r.a.s.t.e.r.s......2........i.d......2..........2..........2..........2..........2..........2.............r.a.s.t.e.r.s........2.........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................r.a.s.t.e.r.s...... .................2.................2.................2.................2.................2.................2.................2.................2.................2.................2.................2.................2..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):349
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.274184634675583
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:90A368337DCDE784B3A1745B62AD242A
                                                                                                                                                                                                                                                                                            SHA1:CFE4A31B324ED97C5B752C894248321BC68A3CA9
                                                                                                                                                                                                                                                                                            SHA-256:90C572A61F759CD9D9E632E4759DEDBBADC65D14B98D1F665FB2507775B1DF78
                                                                                                                                                                                                                                                                                            SHA-512:BA2ED3AE46A429E5CA2A97715174C8FB4E9A5810102C3653BBD43EC518DEA5EA766C35E9D9D220AF75C9274425F6C1EB3CF155F3AFC6CBE95B4EDD407C7BA417
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:58.650 1924 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb since it was missing..2024/10/29-10:38:58.662 1924 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):23
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.142914673354254
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:3FD11FF447C1EE23538DC4D9724427A3
                                                                                                                                                                                                                                                                                            SHA1:1335E6F71CC4E3CF7025233523B4760F8893E9C9
                                                                                                                                                                                                                                                                                            SHA-256:720A78803B84CBCC8EB204D5CF8EA6EE2F693BE0AB2124DDF2B81455DE02A3ED
                                                                                                                                                                                                                                                                                            SHA-512:10A3BD3813014EB6F8C2993182E1FA382D745372F8921519E1D25F70D76F08640E84CB8D0B554CCD329A6B4E6DE6872328650FEFA91F98C3C0CFC204899EE824
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........idb_cmp1......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):371
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.230733152629485
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:48B23B7BF89647FA3859B864EC677324
                                                                                                                                                                                                                                                                                            SHA1:5CBF08BEE6FA930B7002F402EE6FB6A828C4BEDE
                                                                                                                                                                                                                                                                                            SHA-256:C353D964EB35189F0B5EEBD225BCFE4E9ABF8873FDA0BF0696324AC904FDDEC4
                                                                                                                                                                                                                                                                                            SHA-512:4F6157DCA616E906C8F16006E137A45901B38A4717A06D0EE4B1DF0AD5539BA6E40C06236DB5B60F4F87E9D8435709852C6470D1A19A4808D3F82B66E2AEA644
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:58.182 12d8 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal since it was missing..2024/10/29-10:38:58.342 12d8 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local State (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3083
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.487880600456643
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:662FEEE8E3015292FA9478AFE7DA4037
                                                                                                                                                                                                                                                                                            SHA1:E7349917DA8A69D13D051F64DDFF7756ED39566E
                                                                                                                                                                                                                                                                                            SHA-256:BD77A8EEE21184412F745F4FC49CA6A97EE3A6A6DC839541C14F67FD0275794C
                                                                                                                                                                                                                                                                                            SHA-512:3FA5753542AA55099801DD4E3B268D29921D4643121CECBFD71674115E40B7CA40DA9599FC4E6C903B2FF6BBFD4EAA64866778AF4387B7CAD5B9BA9F8FAC5443
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"ab_testing":{"uid":"ZmVmZGM2NWYtYzY3MS00MTgxLWFmYWYtYWU5ZmI3OTMyMjg0"},"autofill":{"ablation_seed":"7R2YBBYBw0s="},"browser":{"remote_flags":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote_flags_char_requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"remote_flags_guid":"af8f1523-0107-4b83-9331-8ecf81b0520e"},"browserjs":{"version":"1712230920"},"chars":{"list":[]},"component_updater":{"media_foundation_widevine

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1174
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.377004327348813
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:1C32E4809AE1A82D73E49B0F2962B46D
                                                                                                                                                                                                                                                                                            SHA1:5AC508FAE26EFDD7CC17E1DEF53ECCD1AD63E393
                                                                                                                                                                                                                                                                                            SHA-256:2C05759414C66CF80B24D045AAD83182D7A5FF7C99D8FBEEE09713125796D916
                                                                                                                                                                                                                                                                                            SHA-512:1734E513640A804D2760F4B902E703FDB0C5130CAD3EAFF53EFFA41A1277BFF1180AD40AF64ED71449194FD0DB5FCE21CA2468480435689CE555B9D11075539D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:#...M................VERSION.1.8META:chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg............>METAACCESS:chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg.........D_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..cpuForceStatus..null.>_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..cpuLimit..null.?_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..cpuStatus..null.B_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..networkLimit..null.C_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..networkStatus..null.D_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..ramForceStatus..null.>_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..ramLimit..null.?_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..ramStatus..null.V_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..updated_limiters_persist_restart..trueS.ry;................META:chrome://startpage..............METAACCESS:chrome://startpage..........(_chrome://startpage..campaigns-user-uuid%.f212b7

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):299
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.231602120801478
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D98507D02E9D8AD51E565815E8CE0186
                                                                                                                                                                                                                                                                                            SHA1:8E378801361808FE8C18B926CE8F4B67F494E4A8
                                                                                                                                                                                                                                                                                            SHA-256:A73B09F5E2E919D4B8B5C782610EF922F21EC28860271B47202A236CF5CCBDDA
                                                                                                                                                                                                                                                                                            SHA-512:8C5153DE68D0E6B0286EDD1B28E14C8F702FC762182438F14D6C47A4893521BC66ED6C86291A8B20C8BC4608B819C33D6A761944004D05A200982DC66DDEFCA8
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:48.528 17d0 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb since it was missing..2024/10/29-10:38:48.653 17d0 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Login Data

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):40960
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.8621516222976348
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CD6917CC36422AED5E2A20A1132943DB
                                                                                                                                                                                                                                                                                            SHA1:481F964FC0721A3338A3A9A1F6CEB7D6B27B231C
                                                                                                                                                                                                                                                                                            SHA-256:0ACE9FF85BC53BE1DEBB74C7F6A767BABFEF479921CBC174496E701AFD2239A9
                                                                                                                                                                                                                                                                                            SHA-512:20E82CC32641275828ACD5BF5AB2EF5F760414B9B77FCD2E9AFEA76DF47615259AC7BA1D58F8A8F341F1492CEADCC3C98243BDB19D5B83D97674E7A238E48272
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Network Action Predictor

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):45056
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.4028722755425988
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EBBBB297C4628BF5E0CA978FBF51D28B
                                                                                                                                                                                                                                                                                            SHA1:AA337992CC26CB38638DF6C022DCFAF8DC90663C
                                                                                                                                                                                                                                                                                            SHA-256:552405E1173A579F6C593EF7366373AFE2E7CE18590D8E7571F89D3F5D97CB05
                                                                                                                                                                                                                                                                                            SHA-512:AE6F30B05F3DD4B0902A100FAD201B2A2C73F2D34332964093859E926548E9DB243989C1635264FF91F8A1DE2BAA4A8942F9B4FC3E592AA1BBACF4F58AA06F6C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................v.......?......\.v.-.@.......?........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Preferences (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):10092
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.008825629061267
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:20E2A8A0A72D776FF63F6462F27C378A
                                                                                                                                                                                                                                                                                            SHA1:56DD578040F6560D3E5223D1A3D3FDD7B384F879
                                                                                                                                                                                                                                                                                            SHA-256:98181243BEFE10624E4F9D6940E9DF8907339602616CC92558DF2651526CA29E
                                                                                                                                                                                                                                                                                            SHA-512:A2B5F2324932506E50A2547C584C97C0C72585E834296D935884C9CB5DF45F12E0EEC8C26B2DF04F32AE27ACD1439267AEBC7EEFE4C5350DCFA889DFE7AA94D6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":128},"autofill":{"last_version_deduped":128},"bookmarks":{"trash_cleaner":{"migration_applied":true}},"browser":{"window_placement":{"height":738,"left":160,"maximized":true,"top":123,"width":960}},"chars":{"next_check":"13374686388134776"},"consent_flow":{"consent_given":false},"default_search_provider":{"synced_guid":"FF57F01A-0718-44B7-8A1F-8B15BC33A50B"},"domain_diversity":{"last_reporting_timestamp":"13374686331979103"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_opera_version":"128.0.6613.178","pinned_extensions":["igpdmclhhlcpoindmhkhillbfhdgoegm","ompjkhnkeoicimmaehlcmgmpghobbjoj","gojhcdgcpbpfigcaejpfhfegekdgiblk"]},"freedom":{"proxy_switcher":{"automatic_connection_update_applied":true,"forbidden":false,"stat_badge_state":"off"}},"gcm":{"product_category_for_subtypes":"com.operagx.windows"},"gx":{"chroma_eq

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Secure Preferences (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):96216
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.573778003571561
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:527DBF517B493F46B1055B32225E257F
                                                                                                                                                                                                                                                                                            SHA1:25D06ABF506B83B4F0B8D8618312260BBA9BFF52
                                                                                                                                                                                                                                                                                            SHA-256:D3E4D8A67D149C4055C0BDC1E7CA6CF57E185652BF12F315565A20F56DE3B2BF
                                                                                                                                                                                                                                                                                            SHA-512:3689A48DD0F45A4477CF0F8E3659200168F107607FE43AFB9441D693C22B19E6B28FA6B7DC255A4F9DE821E54273B9AA26D80AD76055FF721D8CE5DA8E682D43
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"adblocker":{"whitelist_initialized":true,"whitelist_version":6},"bookmarks":{"partners":{"participating_user":true}},"extensions":{"opsettings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374686328536651","from_webstore":false,"granted_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"incognito_content_settings":[],"incognito_preferences":{},"is_pending_third_party_install":false,"last_update_time":"13374686328536651","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):80
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.323098996850684
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8DA62954B0B14642CF287A260418E39B
                                                                                                                                                                                                                                                                                            SHA1:E82BF98669AE1D73BBD9294D9F454044D5C2622E
                                                                                                                                                                                                                                                                                            SHA-256:B7E25784D1B3A3653C618822715DAE7CC86BF0B05FFF0CF3C5D6A1FB169F0614
                                                                                                                                                                                                                                                                                            SHA-512:E44DC92CAA0579A81CBF176A589493421AAD851D7006603B54684EE8CBFC67F572F2B0219F4483227F3FF9CC614D882B2ADB8060873E358C7D6870CAF9E3865C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):303
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.162290656864073
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:FC97148917C7C1CAFDE159FC9C3BCE6D
                                                                                                                                                                                                                                                                                            SHA1:34067AA37C70BC7A8F0E1F79D1E2E7F6C11B23C6
                                                                                                                                                                                                                                                                                            SHA-256:1208BC065EC72C6139FAB00DF13514EE7168FEDCAF7364D6C8712255E79026A9
                                                                                                                                                                                                                                                                                            SHA-512:C56CABEEE14E168AA6418817854671752D6ACBD1BB54390ECECAC2C8B49D8881256F282DD43E177FE8F5651E43C6CCD00B5F891153A9467C83752718695D6A3F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:56.167 1070 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database since it was missing..2024/10/29-10:38:56.206 1070 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):4720
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.989157151413486
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0A300E259334094EFEF49B5F9362A796
                                                                                                                                                                                                                                                                                            SHA1:8264C1CA2F8E4C8A7E406A436702A64F3C6BF59B
                                                                                                                                                                                                                                                                                            SHA-256:2A6509314D5FBE37B230F6F05358D5B5299C51AFD16F810965F1F712365B93EF
                                                                                                                                                                                                                                                                                            SHA-512:4556073E054AD54CDF2B3CF0A202772B339C7F1BF29DD8099444FAC7317B49B3315251FD00530F7FABE62EDB864923E5AE6302E1081B94BA1493D5FCB149BC15
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..........rSG.....0// Copyright (C) 2024 Opera Norway AS. All rights reserved..//.// This file is an original work developed by Opera..const createKey = () => (Math.random() + 1).toString(36).substring(4);..class ReactinatorService {. static CONFIG_CACHE = [];. static CONFIG_URL = 'https://api.config.opr.gg/v0/config';. static STORED = [];. static STORED_VIDEOS_KEY = 'stored-keys';. static INDEX_KEY = 'default-index';.. static init() {. ReactinatorService.updateStorage();. }.. static updateStorage() {. chrome.storage.local.get(null, data => {. const storedKeys = data[ReactinatorService.STORED_VIDEOS_KEY] || [];. ReactinatorService.STORED = storedKeys.map(storedKey => data[storedKey]);. });. }.. static buildConfigUrl_(campaignUtm) {. const url = new URL(ReactinatorService.CONFIG_URL);.. const urlParams = new URLSearchParams();. urlParams.append('client', 'gx');. urlParams.append('feature', 'reactinator');. if (campaignUtm) {. urlPar

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):24
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                                                            SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                                                            SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                                                            SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:0\r..m..................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\index-dir\temp-index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):48
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.9555576533947305
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:284348BB9A71431119FFA6EB89E639D2
                                                                                                                                                                                                                                                                                            SHA1:73D126CDE816135ADFD47BDE421E67BEF4D92BFB
                                                                                                                                                                                                                                                                                            SHA-256:D1C74BF60E260677DF315928B80BC71B7547578620E615D11743B632E1A71586
                                                                                                                                                                                                                                                                                            SHA-512:586DC04769D051695AEA0FB43052BEBA2F52FC4EB80750E69A188C17580337E765DD9A68E2C14D7A00E1E7E47081712015F5519C6F09E497B870A56E94A27B49
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:(.......oy retne.........................t..4./.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):48
                                                                                                                                                                                                                                                                                            Entropy (8bit):2.9555576533947305
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:284348BB9A71431119FFA6EB89E639D2
                                                                                                                                                                                                                                                                                            SHA1:73D126CDE816135ADFD47BDE421E67BEF4D92BFB
                                                                                                                                                                                                                                                                                            SHA-256:D1C74BF60E260677DF315928B80BC71B7547578620E615D11743B632E1A71586
                                                                                                                                                                                                                                                                                            SHA-512:586DC04769D051695AEA0FB43052BEBA2F52FC4EB80750E69A188C17580337E765DD9A68E2C14D7A00E1E7E47081712015F5519C6F09E497B870A56E94A27B49
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:(.......oy retne.........................t..4./.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):929
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.177059777908534
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B4972526C95FD7A4E66D19D0ED6A112E
                                                                                                                                                                                                                                                                                            SHA1:0C0DD1952F7E2FB0E2824D4081CA7E9F04092202
                                                                                                                                                                                                                                                                                            SHA-256:523EFF93B14AC6AB8FF7AE94BC645FBC80C880F8825E995E3D67A1BDFD8577BD
                                                                                                                                                                                                                                                                                            SHA-512:B9B44CD0A878575597A901C71E014713265E034A62461DBAB81BFFB7F81CD240E5F432619664E4635937FC5281F580B73D38EDF066840BB1DC6BC31928DCE0E1
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:*...#................version.1..namespace-..&f.................C.................next-map-id.1.cnamespace-11fa2123_f4be_4831_8bda_7da085d55b45-chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.0.."~a................next-map-id.2.Bnamespace-ff11937e_3825_48f3_bba4_41496c5896ac-chrome://startpage/.1T,..e................next-map-id.3.Fnamespace-cf23c3bb_b0d6_4e0b_816c_773e16376acf-https://gxcorner.games/.2H-. f................next-map-id.4.Gnamespace-26f69ea6_ee33_4650_bd66_9fc83d452cff-https://redir.opera.com/.3.:..a................next-map-id.5.Bnamespace-42f37e0e_8f34_453a_b850_be57e41ab64e-chrome://startpage/.4..y................!map-1-start-page-state-2059949636..[.[.".0.0.0.0.0.2.D.C.0.1.A.A.D.0.0.0.:.1.2.".,.{.".s.e.a.r.c.h.B.o.x.".:.{.".i.n.p.u.t.V.a.l.u.e.".:.".".,.".s.e.l.e.c.t.e.d.".:.-.1.}.}.].]....@e................next-map-id.6.Fnamespace-5daa2bf8_1c29_4f71_a47d_433a50029102-https://gxcorner.games/.5

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):287
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.122749453629508
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D8509CA2E2BC671BAD4522A861BC263C
                                                                                                                                                                                                                                                                                            SHA1:47CE0C9C5AB455A49E963AC1353ED3C4E94204DA
                                                                                                                                                                                                                                                                                            SHA-256:0DA8C045F58109338EC9E1DBA7CFB22A113E0FC60FEF31C4BF6B2B1D455DE837
                                                                                                                                                                                                                                                                                            SHA-512:FBC449CB0E188617E3E6C3FFC6D867E426096468A99A3860622EF0CED8371219DA943A6C29CBD1078394DC1F0B2C9B705E2FE345C66E71402AEE2E56DB39C592
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:52.323 17d0 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage since it was missing..2024/10/29-10:38:52.515 17d0 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sessions\Session_13374686333143072

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7597
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.3112625847075776
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8E923FE680A70AAE22EF42ACD86C32B9
                                                                                                                                                                                                                                                                                            SHA1:52DE20AD6B1FE75788622501F25E8A4049130DA5
                                                                                                                                                                                                                                                                                            SHA-256:372798378996B652B91BB586DD7480EC2B74436FC7F2C5BC392D565AF2B0AD2A
                                                                                                                                                                                                                                                                                            SHA-512:F5A48394FF99E547FC3850240041CCC6B42E4925F6F8280C8C40AA88468EF031DE30FC6F3D25E7AF8B7FE09A6B879A2B934E5542072F5C098E3939A09DE15436
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SNSS.......DV.z...........DV.z...... DV.z.......DV.z%.. ...GV.z....workspaces_state....0......GV.z.......GV.z....!..GV.z...............................DV.zGV.z1..,...GV.z$...cf23c3bb_b0d6_4e0b_816c_773e16376acf...DV.z.......GV.z....s...4./.%.. ...DV.z....workspaces_state....0...%.. ...HV.z....workspaces_state....0......HV.z.......HV.z....!..HV.z...............................DV.zHV.z1..,...HV.z$...acebcb80_0f18_4439_8134_ed351402772d...DV.z.......HV.z........4./....DV.z....{...............5..0...DV.z&...{46F3A197-DB49-410A-81B3-94975C835573}........HV.z...........HV.z........chrome://startpageshared/.......l...h...!...`...................................................................................................B....%..C....%.......... .......................p...............................................:.......c.h.r.o.m.e.:././.s.t.a.r.t.p.a.g.e.s.h.a.r.e.d./.......................................8.......0.......8.................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\data_0

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                                                            SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                                                            SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                                                            SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\data_1

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):270336
                                                                                                                                                                                                                                                                                            Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                                                            SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                                                            SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                                                            SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\data_2

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                                                            SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                                                            SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                                                            SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\data_3

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8192
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                                                            SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                                                            SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                                                            SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\index

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):262512
                                                                                                                                                                                                                                                                                            Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B7CE08534DD997C13BF7BB700A8E86E0
                                                                                                                                                                                                                                                                                            SHA1:287D6C01BF18DFFF697E343AD18BAFAF6F039CFD
                                                                                                                                                                                                                                                                                            SHA-256:0D28E647EE85C96739DF6EB3B82D3DAF0C0392C04751C929685445C3AB086951
                                                                                                                                                                                                                                                                                            SHA-512:8B0370CD3677F3AA605D1E8388A2091AC3864D68A10358E9D8C7154D3FCDF832150AA7F3947E2CFE3847B064AD9AC2F7D3D95306CE5C61C8A5375EB05F96A5AB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.........................................l.4./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\SharedStorage

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):4096
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.0905602561507182
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B016510815CFC2BCD2E04D07A0D4CF80
                                                                                                                                                                                                                                                                                            SHA1:8B67DFF3DEBD7898315D5051C1CA791E3EC9E25F
                                                                                                                                                                                                                                                                                            SHA-256:02E374A9C1AFDD0D65F515922C3343CD3EA5CC8CCEA04D9F026A9406AF752B55
                                                                                                                                                                                                                                                                                            SHA-512:5AF6956CC960770D5651B19096A0F55143CAC4FE79F76054042180E9EBBB322A9B1A29DC4FBBB8C12BD8708BB2AF67C8B4280B70B0D1192021FD8D423333344B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\SharedStorage-journal

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite Rollback Journal
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):512
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.28499812076190567
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:FEBE6256B4693F0B419DC0A989758F48
                                                                                                                                                                                                                                                                                            SHA1:8EB16CA3C5BD5CCD80FB52FCB9BE8CF8B463C755
                                                                                                                                                                                                                                                                                            SHA-256:10385627BD1C8F1307D4B01DE23E264C9F7900A028800D311082B5B3632CD53B
                                                                                                                                                                                                                                                                                            SHA-512:1E5FD9BEA031A318C8189E4CDC401CCC4CC3C70B5B15A2A143DA6A2CC0CE9E290F5FA1B580F56D35657A846C598245832631C20D70A057FC6DDADA30E81A4BCE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.... .c.....hI.2................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Shortcuts

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):20480
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.4355788121928965
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D08E89C67B96F8B4C69549952F40D807
                                                                                                                                                                                                                                                                                            SHA1:99B421E849CA76AD8CF3A45FC212961306F1272C
                                                                                                                                                                                                                                                                                            SHA-256:573AEB98AD60F2762917498C221DCDD1190678FC214C8DBE9347AA8086AE8765
                                                                                                                                                                                                                                                                                            SHA-512:9199F7C19792F62812076722F3DCF2585E22857B6041772E76101455C68216D66F209D87B291946AD574D4769428D4CC8BA94BF5E6F8B2BFB1F6DD4B232FAE5B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................v..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):40
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.473726825238924
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:148079685E25097536785F4536AF014B
                                                                                                                                                                                                                                                                                            SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                                                                                                                                                                                                                                                                                            SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                                                                                                                                                                                                                                                                                            SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.On.!................database_metadata.1

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):315
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.100514939481562
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5FA0AAF485F1013B1214C107D7174777
                                                                                                                                                                                                                                                                                            SHA1:36940519D79533C9372A3383E2D561E1395CCB24
                                                                                                                                                                                                                                                                                            SHA-256:367D68AF054F8AFB744613984C1B73EFD5CF135E3B01798F069933FFB0171FD9
                                                                                                                                                                                                                                                                                            SHA-512:C5AD66CDEA8537B52F210A08FD4EA438C0F5EA4B300D92FBA611E12C0EED52CAD7C5620FB32E0260B274EF2DA259AC903FA30F3C99B6DE71668743AD4CE4B295
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:48.187 12d8 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database since it was missing..2024/10/29-10:38:48.437 12d8 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\02f01608-f834-4df4-be79-553af2a55504.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.979451195919838
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:907EA90E09D2487AFB74DFE8DFC59C06
                                                                                                                                                                                                                                                                                            SHA1:920E3F58AA94324681C2F0885939B7776478D501
                                                                                                                                                                                                                                                                                            SHA-256:9BC4C5CF36BFA4733816DD2D1E734FE543E97647C8AAB751859F4ADF1CE3FC12
                                                                                                                                                                                                                                                                                            SHA-512:8405993884A5DF374A10AEEED8F9A22BD8FD873E2D58EC8AE6870B5D8CCEF26E8B8A2E7460A7728F8CC6D6185B61393B8F7CC9B2C2DE5A3678C7213B15CB5134
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XSf07j0n7gY2ik9HsxjzBcpcGlYE0pKolVsM+2inwjBs=..........|.....B..M..:)..y.@.W......a....^..|)..s.;|.......<MV. k....R..Vp.:.Qhv..K\.c......Z..'........;...}.=...U.}&.(M.G'Mj.........S......U.\H..4......q.3....N.IK..VN...H..b..;.V.z..cl..d..o....,$.(.Yq%N=....]...A...4.....=..V%...2 G.....,,..!.t...........$. ..zP/7.r.;.]7.W..P|..S66.C.....p...IL'....Jax.l.L...uM.0~.....sV......G......O\...v.-<....r..`.<.Bg.......U?..y*D..ATD.X...q.M..Iw`........de.PM....an.^u...D1.w.Z9....'...W..._.[.y,.Y.f?.@u.lH....vW.y...[..J./.7.~..A8.c2..e..=.N.$.~..|...WmV...Dv|y[..1...D.Z'.....#.....U<....7.F.5...#....!1o/..B........:}].....tB.T......m...A..g....&..H6c2...7.yw..SD.H....'....j........2z..K..\.....*.6;.}.)N..+:.*..UA...x.X.l...!b.......".*.Kyi.....A......z.\.@..h.I.y....[7_.B...J.Nf....%U..o.y.6...O...|..,.?Nr....V..}.....um.t......4H.s.7............3r@...U.....Z..Q..7......OKq.U..cnw.=f...bt..]g...H.<AG...+..._......6.ho.......D....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\06b99626-ce5e-4e77-b7b1-bec2a86b11d4.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.977629736659921
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E9B4992F0444A5112C8E24D6A358D302
                                                                                                                                                                                                                                                                                            SHA1:28195508425F8EC2FDC740FDA43A3B9512CA18F8
                                                                                                                                                                                                                                                                                            SHA-256:32A100DA08D34DB4D336E710CFD9296A27787FD1806C013C96B2EAD6FA538F25
                                                                                                                                                                                                                                                                                            SHA-512:396F3342BABE0C32ED0B494DF49C874CBB9C70863581618E444DE9177B0D8CB9F57584C0B1829419427AC3E1CADAD377954E9D7FD89E1EB141A16052EBA5DDA9
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X9zg+KVxpzBtM50g2vllPyOhTHUeVHK1oL8z8Qgpzacw=.......=...G.0)./+d^.w.....yLb.....|.d.*r.]f..R..<c..9.X..Y..$./..x=s......$..<`...@.|H.B.....1`.n..,.t.B.hYX..K..>..c<...4..{o.W..`.Z.../>{J...........B.kp.=..i1..J............q.W-.K....0....3.Q.t.......]..MVc..i=^..O...F.p....O:..\IG...........!5..y.d.Uu0.....$..JM..."g....z'...G9..i.ha.....;_7x...3.G"D.!...jY...n.......C...F++.#.XV.#.f.A....../.7..jN;1....x..f...M.R.Y...E..5..49.TU.#.x..a..7...T .....9*.7....U...K.....D.-..7..6..$8.}e........A..4A..5.......d...a..q."............Gt..t.....DQ.A{..&.........x.....)a[............k.0'..D.o.....o1.|%./..q.UB.;q....I...$0......RmS.........2NA.-....*.y{..J.{.YT..pT...9.3...:..._G..._:.k/z..~.......UT..!l.E<xN..u.=.EuUI...0.R6..cG....&;].^K...".?...ht.....z.....lu.j..B......<.E.~....<....{e..........>.hf.o.....5@...f..C.$w.E%(..N.v...'F.o..55/.w..u..,yK..e...{.2L.....M.9.r....y.Vw[...m*......},.).3....#.x.....+pz.J......)+.o_.5.K.2.:.sx@....xg./.5..v6...6..yx

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\080a53a0-1f50-49b2-ab39-169d5555c4c0.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2061
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.913074019609259
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7D4DE15D92740373FAE8F513D620FB73
                                                                                                                                                                                                                                                                                            SHA1:C2EE5F524A53D0EC31B6F7C4FA466218C1194736
                                                                                                                                                                                                                                                                                            SHA-256:28299E7FA7A6B6BB0F29B5E90255AD77D00AF0A5D5A1DF10BBC6EC1E35F73F24
                                                                                                                                                                                                                                                                                            SHA-512:FA37A40B2E68F840B909085C017FA4E68F02EA8C715D130F318F87B923A1309D2FFBD4E89C2D072C441B9FFFDAC02A7880055152F963810C9A71F59B8825BFF8
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xo/DGm5h0uYYeuU/HGHfOV1jHmGg/adwCqapqoiUMCzg=.......D.`V...L5........q2.7C...V....0;....<.]...]...o.6j....]1.r.3.)..V.H..C.o.....,.,e.r.M*.}'...h@..<.......,.<../..&. .'.{...i..v.'.;.A..i".......(.?S.......5..7..,.s.[........`.:N`..5V..#UE.8u..%gK5..!...=....D.W.o..XP=...w.u.......xl....X..L....A.n.}.....[PJu=........3..`.l.........I......p5u}."...h-.....<....(...n.4wC.4{....=.aBA...{CP.P.f......._s.%.X&.`.H8..\....).9....).KL........W..7......<)......h..)Jw.?q...E.p.....r..Wf..W W./$$...:.2.R...1$8l..|....H.uV......u..p#Ft!.I~.#s.1..l.SW....}4..J^^.G..4.c.|.a.G@.........6..p.u.SH>.?.....$.}-.`..)Wr...j.y..%O.2....q'T......"E.RaN7...4.!.V|......1.D0.......j.~..E.....6U_..?,..-...g..a.........qo..............#?c.&....<.2...1..b.J.I..j.*....O.t..q..{.&.N..X......P.L..*.t..B.,...%0... F.g.G..?....-c.i..o.8N.$..*..g..2.K..$...S;..a.mYF...&......`..C.'.2v.....q., v.#.'...|.k..$...D.eAq....xA.U..:...84 D....6..ss]....1...+B.2.....G.P

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\08d06627-2d92-4b6e-ad56-d9d2bdd457a6.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1245
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.834716611491779
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8A0A0D89EBA6A7774B7077948C0D731A
                                                                                                                                                                                                                                                                                            SHA1:FC0F141106109E8A7567CF901FC10DBE84AA6756
                                                                                                                                                                                                                                                                                            SHA-256:792129A22281F887D1BC7E63DAE68E95AB9803DF2FC137453205EE41D9137959
                                                                                                                                                                                                                                                                                            SHA-512:3E89B54F2CC95EC0FECC736886B916DE17FA7B1D8EBA9B7555695080EB1B09679676A87597853172E9DE9AB072CE97B2642F5A1E8F9B0E6F86E1403C69DA3DB8
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XHMXRtYy8a50x7t0J3mSys3Sie7uQoQW7oZ+D1aUkwGo=.......b.m.........Q&..Bg.....;....R..._...X.$I...).b..>FOC..W.0.7.<y.PAf.$.E.Z....y..-.#%.K"W.....$.`.".*R.q...^D..C ..F.L..}.6.*.....|FvuuJA...=...s.t;..c!{K.....d.po..fu.+.L`<...I....>...!|......M....A..N1..J..L.j.2.".|.E.......|..=....=.k...I......E.....87.%O..X+#.>:/........Q#.k._...vh...a'.x.,..=+zHz....G..C]...>....8@.....x..5.'.H.c../.f..qY..,z..{6.......@o.y...<2)..[.y....&...Z.v?7.N`K...DB.a6.!/$&....)w/.......E.i`.zs.K6z.|.....H..L.Z...LI=k..o.{..O......VT....b.6.zb...].da.O.bEQ..P..y|...@},.._G4.:JNT....`..S..>..."...~(*+?.%\..+....b}+..^....&.X.z.W ...Tq.r+..s.S.G...'r..C.^.....[..Z`...K,T(#i.@F.6.Y'..f.N.8...}.-.Q...r........@....8"w.$..'qB.df..7JSom.a..J...f...w3...4P.....g.s..&<.?.%.U...!..jM}.#HRV'^..Z.+g....P...gqIv^.Q.....e:gP....3..J../Yn..Z.....}.....b.(.g$"`...K.;.W...w/.u..".....*K.]...n@.R..`w......MZ...s_.Kbx,...g.U..g.A..3.X.3.!.E..`.f.NF.:v@D.0&.U..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\09016a1b-92a0-4cd5-a896-cc5ac5ddad37.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7549
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.9743231036071505
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:25B1A4F5FAD906F33664B632BA3BDD69
                                                                                                                                                                                                                                                                                            SHA1:0A94062B916D7776DB0C6F64DD9029C73B273E0A
                                                                                                                                                                                                                                                                                            SHA-256:24F9C0E46C1FF3C02A59C0595ACF99B58EB86924928D60FE8F2461A69D560D22
                                                                                                                                                                                                                                                                                            SHA-512:C471E27FF142A1E8B8BF792D492F87A7E20AF63EAD378EEC6E5EF30E1341BCDA4EE7444EE2190FBE82D407B4B8C65CF4EE3FE0BB917914325FEF18748E65A907
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XTy/Zs7xBHt3rsPQYKVnmd5cA+enjCdf7EKC3IP+1pnQ=.....u..N..L.....}W.?.9m...L.c/..O....q.`.m...UFe...#y.7...ad.P....<..: 1....b:.E.....i.K^.a.....b.....q.w...OE..A..X.n...."...............!...t..AB.)D.K...F..S.F.......QC...Pdo..z..3.....a......Z.OV.Y..;.:...f..8..g.'.4D...W<6...IM...JWL.g....l......{......B.R.{>N...>..+.6...rp......y..\..d...\...4Y.!,.6..-.`o...WC?..6V?....c..c.6.7:...-W.L...E8Z.!M..[...g....c......%..;G.Z~....ow....V....../.&..K...d..&..&.P3..3.|.;.je.(.S...?ZIfybY.........d5...]L]@hP\P;...oa...9....U.F....C.;`I........FFrB]...<...........c|.C.{N..".....,.qwB...AnC&j.:....O.x......Qy.K.w&..u..d'.7.......m..U.....2.M.0...bJ......x....,.<......|8ax.p.u.m2(.....a....EM.............k]r.u.z.`....8.p[R.~.D.<.4t3.m..B...2..T....g...)nl,*.............!..x..:B...Z..........5h........3.[......j...yh..m..& .to.d...........1.L.k#.hl....:E.p.4n.t.4.<Rh...5.c....O.(.G.L..r..<.s.c.z..>@...W.....-:..u......Y.~+,...?...../($...(.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\0af81a35-729c-48f8-966f-519c22db21ef.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1725
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.877935316164971
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E705BB5E5675AC9E879B27588ADD27A2
                                                                                                                                                                                                                                                                                            SHA1:7EADE2C75A24A151EE71423FC5AB7BA50D2052E4
                                                                                                                                                                                                                                                                                            SHA-256:50C5E347956197868600841DF5F98FE4E9E3FA6EF360C44F2A1845C6D638A9E9
                                                                                                                                                                                                                                                                                            SHA-512:F300A3B52CA341D36EFF51DE5245DB3E9537E849C1644D937B6544959841A6CAB9A47FF8B487C67DCEF7C2F26207B92F46288215FD564D324ECCE64390DB6B34
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XPKRVlWkzlQMkjkaubeDZEhDVBCSYbbLJvJUUNWBfIZg=.......K........[I.....@i.w3..22N.\.o'. ......."..3m.. s+...;..&.R..N.x<..!.j....Y.....1+....pd.....s....-M.:A.6..LE.!.v..i.{h..5.eZ..;.....1.$.......ELr_....=Ih2{5.g.[..!.2..3....G.2..c.4.-.!L...][...3.......-.'[.,.I......(.E.\J....S.... .{L6In.)U..&6..0r.TM+jL`.Ow.~........l!.P..$...C+....:.......8)...i?.H.6....V.c._.X.UJgP.....t(.+di.v............n;....a\FY..nE..@...0IF....[...wV.....w...6.x.....<..9..u.F9uQ.Z...A.b..-.F-.T..]au........*..0..c^/.......S.B...V.. ..k[._...RU"....+X.....<.1.....nnP...[|....,?. .k4.1t.q.[.S..G.6..r....M..}...b.L...7.wDt..Wq%t.....:..>.l......2.)C.c 0...i;EfC.DG.H..)R..a.'..Q#...L...........HZ......ZE./..._0.a.:....m.kj.x|.....[..-2..s...`....u..v.un.....r._...._.$...^7..*.;....C.B...'..f.n}....6...y..D.sE2..^}z!... :).A.S.w.@...w......q...@...!.42.x0.}....O.i......|.......6.2..Tc..>.....).....)..ey...8.+......+<).L"B.1*.....!?.J..."..3......2x.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\0b6d34b0-4269-4e06-ba2b-02f8f494bb81.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7693
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.979355278779859
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8E071365EA15855168ED76099EC33EC7
                                                                                                                                                                                                                                                                                            SHA1:F056F132A43B76E6238148E79720885541B57CBC
                                                                                                                                                                                                                                                                                            SHA-256:2337F409AAA69429A430946721EF81AB626F0646EC622FC8AD1B5D34370C5EDE
                                                                                                                                                                                                                                                                                            SHA-512:02A179E8671D9C19D9239CC2BA2F6831698ECE22CE4879DA32C92233C345B0C7CF2986DCDD7BF43A133CF953F0CF8A6CC2DC29F51FFB1FA4CA79558158DA7477
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XDAOy6Yfsrxu10udZAU1ppztK0yzXTr6cMyxBw3hknfY=.....w..&.a.J...^.Ss.<.1.......Z.HA;.n...7l<&..D........lq.v..v..s0..e`Oc.~...:..Q....]..c.tq.M'.5f......m.8dS.....$.+...O........7c....s*TG....3.n..^...d.... #l.....[.ir.......P4.l.&..k.E[m..!...zM.aX.5..nQ.........)....M.........+.A.t\...x..0...o..AB3TM......E7....JL{.(A.5..-..6..t]...5X...........`.~..@Y..\WF.%.F...b^.l...x.........O[/..F..Y...........-..(.|.'..f..:T..u.An7..Z.(rY...[e.SE...".y......tJ..O._!R.....Q..s.Q.%:.I?=._..`.}O..=}!.o..!..h......2`...G.X#.5.`.@...).T......,...........B.x$?..s..s\.p.."L.N.Y.OP^....c.x.L.X..z.?`........po~.`|.../.N....%/:,!<q<B.Y..:(..v.*..Z.oU...7KY@.Dj...,^f......S..K...|o..!.[....1.n....c:...i$A&.#......yU%#.Qj.g4e.'.?.{.L..K(.x.....x'p..HP.z.V.k.i$H....8c2(`.......0./.=....k}v.0..~_v..].|C".$.6.....!../EG..5....../.F.....6..6[...Q.....\...~7Hs...pR.De....m....V...+.S%.T.......k.Es1..)...'tA...P.....-y......W...#.?.!d.G.2.c..Xx.........[.\......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\0e614208-8fe3-4106-a5a0-b96e74ff7532.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):733
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.736523491918488
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4928C299963625610DC9FD7CACD39D85
                                                                                                                                                                                                                                                                                            SHA1:198EC07D30654B31F9BA56AA0FD3027F5C2E71FA
                                                                                                                                                                                                                                                                                            SHA-256:AD636A0AA6131C3FC5A387241B2835E51C72EEC90E1C4E026D2A054424611A96
                                                                                                                                                                                                                                                                                            SHA-512:7CF629C4877590052CAB8A8140E1465433D1A28E96BF67CE4AABA55DD6310A5C2880C3038794B483E1087F1ED062EBBFF456E5A2827CD3F0961C0A042D57B78E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XbouK/LD1ZBoHYsrE6qvfDYTHiVEYuhe5LbUD/NgBD30=..........."...OnP..U.......vU.m...j.m^.qx.7g.a$..i..Avv*........B-Q.......9#........I(.#....XL.".rYn^.WT.9&........w.s...H......f^.......R."..9./%=.q.qd...........$..P..O$M1.0.!M[v..z....YF....|nR.;Q.._...>m.......H.Nz.j..)..%.>NW..]........J%Y.8.......b6...e..d..............Ir...:.. r..`.A......E...[v...a,....n0.....dz.kh....4...:...eT.A...`...A.%..+......8....CS.....wJ.=....R.h<.%$.UJKu..&..E.o]uQ..-......O..pD..Z.1.....P.xo..^.c:./V.P..=..!.4{..-....L....T.....?..J.5....p/hDI.c.......8..K.......f...fx......'..O.....oE.Y....tpk.B....0.9..L[&...AO..|.......[d.3.;..c......!.;o..].L...~.~.J.....9.s............/..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\177c390b-1b12-421a-8cb8-b8df3ef30627.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8702
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.980038188570601
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:39F83F4A5D261AB43EDCF389F712F1BD
                                                                                                                                                                                                                                                                                            SHA1:2E9E9BFA478F0FD4766FA97D6354D4CE2B1FD506
                                                                                                                                                                                                                                                                                            SHA-256:58203D527F3E53AE8C03B0A28B15DAEAC66EF3C640308D123E13461A2D5734B8
                                                                                                                                                                                                                                                                                            SHA-512:D0E827A5081EA0CE4AE98318FC81B13CA6712857CA912F11F3D6782B0CC6177EEC32EAE0309F3E1BB8C62EC52504CA7A035D73F53EF65B0D5CA4ACE989C97759
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XMQD9IL17SnenDJzJslXCFiY1oElQoZZajj+UFRvUvWA=..........E.5...!1.q....Ae.7.;.e..8...W.h..u..3.S....@...c...w.|......o...8....I.UT.]...5p......p.&5o..cP....R5..........7.q.C.{.km.O<Q.......V.....Y.W......'Dv...../W..e.br2M<.o..../].e......F....G..S.......?..j...k.........a...d....P!.d,]..WS37f+.h...c(..h..X..-w.~!.w...._S.$.7>..'..u...Et./..EtF8...4..w.w..p?..6..V...1T.......U.+<.M....,^.F?N.... .(...2I..BvU.>p.....V|..\....w.....1.o*.J.;$.Q.:.z..8x.....AF.....@.0.NvpT.R-i#....K..Y.}....r=!....P&r<..H.....VF....Y..D..,...?..5.}xi.B...4S.\2..._..b..f....Cvh..z..0<..%.Q\.9V.g........_...P.L.p2..(..[.k.R.vmB?.I+Hi.fJ..x...KGb%[,...E.....hc@<YLPI.^...xt..#]...X)rd.P..........o....:H.H.-....%B}....8..^...u...,|..I<.......p. .]U..d.|...N.NG..`q.|~.D..4[h..q(N.c.Q...K.w......Y.B1.;..s..<.$.qE3.\.g#!l....n..9O..M....eM$.C./.....o..w....;5...=...a....a._..\....Q?6q9=d..d( .@.$`Oh.....c.l...;...V..................Zi...v.bx....n..%_......Wz...O...r.j..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\17b9257a-74e5-42f9-a1b5-ce35e2d20467.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.980649624235424
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:67EAFC7A641FE1AD577026C723DA2C6F
                                                                                                                                                                                                                                                                                            SHA1:0EB99A0FD3053D34FDBE58D2B010DC6233991639
                                                                                                                                                                                                                                                                                            SHA-256:5618B140BD95FF0B32E950807F835CE0892B7271A9404DBB425719F19E1BE8B6
                                                                                                                                                                                                                                                                                            SHA-512:D00A16A345E9FA1497FE3DDFF07D10E2F8FA01855550A3964AF3A68C7D41FE7DB397BA154228ADB160F0B1F104577A5EC2B549443F414ECD04ADB4C528A3B747
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xnu7zkaEEKP8hfvknHU5RCnI3fvpr96kle5cbeSsmINU=.......~...^.).".~........r...@w....[..z.~..y....;|g1P..8:+..nh9.rS..z.o.{...*....}..4..l.q...~y.D...7.....*0....Oh+..Kb...T.[^.2....._.j.[....%..d.#.b2........^.1.a..T......]_.b.z..O.........V.e....Vdy....36Gi...?......6....?..L.....*=Z...j....-...GH.D..l.j.).;.....[x.k(/,.$..U!L..5~Y.P..A0....u|gu.nH...S.c`..:.N.....e......U.y'#....3.L...M.?.]..z../..\+".(ZC..y..ud*..j.GSt.g....Q...^.........|....u..|I...3..Ch-...$.'\. F.Ff..`Sv......<.f.`,...PA...)...k..Qi,.../D..o.....Q.+.9..4.C....>.....`B.m........k%.8.9...DX.....=..sG...h_:....=.Ask3b..I*.S.3oQg...H...5PUD.3..2&&..N7VU.rj..).\....,<...le..l.X.ng..<U.e...L....@...J.E...8yQW......W@e..H.D...~.....#...i4.".].P.'\....oa...WL.{.Td'.U...i..^.$z..1.~eh...9...C7'0.....>5.@..H\..J.......-....}$.u..!EL..._....`8uv*.9..O.O.9$.G......p....Uh..~8...%......%.2.N.=..(....|.:y.pp..i.+.....I..5z7.C^u,.....o.e..%..}{.J.........[:'.x...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1aa8d78a-8e56-40f1-be39-e2795ffd8a53.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.979602210101578
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C0B22EDEE1E7686136E9D24A50205743
                                                                                                                                                                                                                                                                                            SHA1:8DAD8101C41D82649D63A1284058C54EF880B1E6
                                                                                                                                                                                                                                                                                            SHA-256:3C3225FF8605AF51A63512E5BF52856232D2C75D1D8F3191F3D784127CF34027
                                                                                                                                                                                                                                                                                            SHA-512:74BED9B4F7E3CCD87B4A8634F8E1047701FFDC531DF77087939D81221BCDDFC7479D890C1A86F98384D38B7F74924CA770A5EBDCDA3924A1E231D7000BCCFF34
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XDjP98DjP9BZuNFw5DKbGUde9xttv6LARXSAP+vom8J4=..........-.7....l.....a.5>.TC..k..L..q.....gz....SY.?.1NE<j0.7...?.6d.....v.....I`.Q.....\..X.m.._HB.8K.~....V.Tr......|.sxm`...&..../.*.kb.0.K.....\..@\.'..e<.)......\..CS.E...9,..B.....O.f.f/..-.?.........s....x{+..HP.e.(....Y}...pT..q.A#...^)..A.8Sz\9..|.SA...G........4.3...(.-.. 1Q.=..l.......~.&...&|.(....r.......h....Z.I.....W-X...{!}[....U...`D@ .-.$.w6.N/.........J.z............e..&v4NP.+..-U.....2~..n/$..D..>...o........Z.x.8K......w..j....[..I...AI!..U..........J.nH.n.,jAw...h...r...W..|.$+E.(.>.}.x......8o..h5N>..y;.9,...K+z.....,.;.....x....c......I..<..HL...KA%.+...g-..^.s+......qn....%^.....4D.(...#5@j....E%".v..>`B...$.-.zeA.b0r.\R.`....as[:........'.et.S>.MJ.0.9...ld.k.Wu.E>.l~.'.~'....z..oM...=...a=45d.-1^..[...v'4.#,rr.JI<..._..dE.p..K_......|..^-}~....Z.S.M.\.V.ma2..M.$....o.nUH1...C=y.9.<G.1.,..%...:zB..*hWN..}e.Q..`B"..Nh......6M).H#F.D...$$;g....+.a}........z4.n_z..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\26a2d6f1-d123-4863-9c75-e9c206329030.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.977301900300146
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:1DF90B88BCA82660D53D9C6F7B11C905
                                                                                                                                                                                                                                                                                            SHA1:66D2EFC1F88C648FF34A0BA55DAEA89FD9567510
                                                                                                                                                                                                                                                                                            SHA-256:9A0751B6656E1D925640647373FAA4C10D15059CA4071005ED441A8F7CBC3F43
                                                                                                                                                                                                                                                                                            SHA-512:856D5CD93AFA564FA6039E8BD44E39A477EE73A896B9784C3EBC7FE29CF63151FA41731BFFC8D32A2C78A877316D6CC58C4EED3E5B87953C0E3BF8B35B17FDF5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X8Hgrkg0x+epS0K2vlDBZd7SLt9Fpid4mTRR1CnoecIM=........v...G...$..U)....G.V......w..t&....a..'...V.f..{p6........b.Q..e$..B"&.._~.....,C.........D..@L....D.!:..e.6}.}3V.}%..n..aT.<.+.&n>....e!..BZw!.y...X.eM..z.:...r.`..]..'..N.#"gt..uP.7K.[."..+]?..L.I+......2....>X...`..p...`...\.W.<.....U"B.%?!.9..&....j."..........'..E..?..e.?E.E.....~x./..G!f./#B...J.4.......m.F...7'......q..6..<pK..tZ?...t..C.;S.Z....\.'.....@.....yi4A...%.,&iPB9.8u9Sq.;..z.Z..n.S./_..f..%.t<......5:.[!......i.\o.`._;..9gN...q. ....V...:`.-q=m.3.Zm.T....B....._.........|.}... z........2.R".t!."z.=F...l'5{...{c}4!6;N1%A..6.)..i..k..H'.9i.z..."]./%R.......;Z.~H!.....X..Q..uo...v..2.Z.-t-.b9..........Q.(...T...v...q.9.I]}}....x..m....Aj....;p..Fe.......mCu.....Ws@.D...R..d~..[.z........M),.<.e...;2....|)...[=....mu.{v<N...5..W..NG;;.|.....o(UE.MT.P..e.....3'2..$#......G.6<u.....H0..s;. TI.....l..*C...=..}..^..6.s.(e{.I.`..B.. ..M.}u...%2..(...G..8.....dX.P-D%.,....{()Tz23

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\27d7315c-9d9b-48d9-a4a9-8624f6ea8dd6.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6637
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.970118184651459
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C0C6E147FF804D06E38CECDEE5539B55
                                                                                                                                                                                                                                                                                            SHA1:AACC648551F753EAB905C073A76873141A13B5C5
                                                                                                                                                                                                                                                                                            SHA-256:DBE738F6040733FBD111422CD87B7D9DBE854EC0E9A4B85B9933E1FEFFDAD453
                                                                                                                                                                                                                                                                                            SHA-512:EDDCB09D0B742B2728D6B4EF56C4022EA6B6ABB9371620F86ED02A704B246B7BDF181BBECBB746B6501594A1485DD6EE79C7815825AF8381A76BA9802187F977
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XTm2bTX2n5Y8K3wVVorfR39iEDNY7DtuEDUqHXTRBYdg=.....f..\...&$K..=....Ke.m.|.!t-,T,.Uf:.Pio...h.9iS.0.X...U.Z.~......F>..p...w....c..g...9M.B..K.;...;W{........#.....Hj......|...6.;...@.)...=.[c....WN.....a.....7..._.y.c...-....#}Db.u..."q..-.......H....6.k....r'.........V8..^.!...0._%\.R....t...)..A..!..y-.+X..U.C].-.O..)....0D?..l.......tw...d....'...4..E..{=..t.R......Q..A...qC..c.LS.{.G.j R.AW.T..*........m.w.:.z=....l}.Q$...`...s#,...,_y..X.&C......"..B...\P$.4.&8.(.]..8._B.....n{.ho..c\.d0_..sx........R.).?(O...~....{.%.R.I*Y.._.....8S=.T.h..7..`...[.QQ.&..9.@"..;..NHw..BH...._I.Y....$.W..!.,#..............6..*.Y.....~)....i..@H?. 9....,.P..w.%.....oP....o...P......r...?b.....Y.KBp.P|.og...C..2...j...........!............hd...S..7[.g...o9_.......b.f.D8..?.../.2C(yLy.../f.Q....4.>......\J@r.:n..g.l7.b....W#)..._>.m..@;.J.......d....x...P..p#...E..v..R...H0.yQ\...~..,.#=..}..;.C!8.. V/......9.f.g.p.~.Z+.>...@.n..:...9.;...........i

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2809e16a-3bd6-438b-8562-478a6f3f2fe0.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2826b720-51f4-4cf8-9fe9-18dc783720bf.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:modified
                                                                                                                                                                                                                                                                                            Size (bytes):8702
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.978746322120924
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:1E0EA682FC2DCD1969920CB9E7D8FC6E
                                                                                                                                                                                                                                                                                            SHA1:C49F8061A898859A7C1FB368284FAA17F03F7876
                                                                                                                                                                                                                                                                                            SHA-256:D5D0055473370B0312DA206316DCDE9FAC34D55640D380F3B8F20A503597BB54
                                                                                                                                                                                                                                                                                            SHA-512:B93667C29ECC7992FED54C8550C823FF1BEB19F04A76ACD5E7FC2DAB652F9B2B772380FDEB1BFE166E44B282D34CE11932C1F39E0F75370D45371C1D57D28096
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XMpGldi+2Qxtw2JQO0rccIWnyrPVInjKWr4jD/021BVQ=.......Qy.....o..B.......k......I.^P.Y.....P.-M..6..X)U..%Q\.AM.C...c.}.....V.5lOUc.]b..B-.2...8.'.?...J.gRo.Ay..N....@.O.. wi../SA............#.+.3...F.c..b..a..V...z.TKsG....d...c,..V.9...93.R.C.....#..G.....aKh..N7LB.IC.f..j'...Bxm..oI..>qxP.=..<;...i.8..}...g.g.n..Ub....<4....6D....Y....Q..\2....J.K.U.}...-...!...J..U..LI._...?C..........Zc..,e........F...../..Q./+.......kC.....)$...P..(..LwvfD.....r4...w.E.......{e......r.Arn..y..8...o.*!.0@.E.G#....#h..I.)sF.H_.x&{^...N..a...{V^.|^q..vO.O...9;..c...[.\?..y.^...f...|6.%PT.V.94..~hS.b.)......6.x..h.w.u'.^....aJ..&B.XQn\...C..,B.K.E.OZ..`P_.|.Afi03........>O.. 8...w.6Qf.'j..%......L..{Mn:....e....'.........|..5.70.>z...e...T...&...../.....X..=5.Q=0F&.&.'...jv...!Y.[.W..Y<.O^. ....q..wRR.....i..HS?..G..5...4.............B.G..l.E.....Bn.O6a.C..[.&...J.'.L.F.q...>......%..OZ..p.)...d.........<.bry..m.=#.....v_.y..tI?...??.v4....K5....T.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2efe0012-ebd0-49f7-9b82-0e5386912a23.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1837
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.889354582408967
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D76AD60CEB5BBA1655BD7345982D92F8
                                                                                                                                                                                                                                                                                            SHA1:0BC0147DBF45E3CA57CB0BB1283E8318D091F2A9
                                                                                                                                                                                                                                                                                            SHA-256:13863346BC39DE21838A0717DEBCA0927B47AE44F577769184E1178261EE8DCE
                                                                                                                                                                                                                                                                                            SHA-512:AECBE532F21432B209E31F3CEEA19109D34B1E9AB80996997471D6A66EF47997E2B82E4C66D1733AB719BFE834F37E7C756F80663286F91C902DA9C67CD03080
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XZMYlA+B/l9kK1ngmEQHfglShY0WjroaozSDgVozu4f0=..........m.#.[..c.+{l./.B.O. ....&U._G.+.@..*$P..-..{.....)....._0....Uh...%...#..N.Z>...U&kE..........7.c..$.....{...9)\O`(....gx.y..:.....R.a..2.Wze..?.p...Om.G.0^..0.K%t.......Hy......[f........z\.m*q..(.........;.........<.2...l.72$g.....m...TB../".....T.....P...gD.....;F.851.C|.[.r..../......y<_.1S.c.g.O-h#....^..rq..%..?.E...u$......`Y...........bI.l.}....D......t.qI.-.*-.6C.$.j9i..H.+..A.:./nMC.Ab`..z.?.N...rE.9...._...d[2....V#|..S.(.6.N...S.@X]..k4.o..T.<..s..r..d..+]S87.Kf.......oGG.<o..V.,._.\.s?@....-3.P&<|.......J.d97...(?..[.3.a...y..L.J1r5.....N$....l{5......!.`]...\koE..6iH.2UlD)....K.K.....H.[.K.4c....I.6..v&.<..uj.1c.NM.......#.BlY..&e..p%......nL..V...@R......Rx..O@...k..8Z~.,&.K.k;....pGE..ff4<...9IhI\.m...U.....M..O.8.y1<.@..< ...........k...S.}~_...o..2.!.g...V....A.a.E.~.h...-Mc.........]H...$.Y....kJ..t.....)9.....N....g...|P59..~.-...b>._......O.....F?:,a6.\

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\32999a49-2a39-4f2c-8b3c-e2ef93c7ced7.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.975147646164618
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EF5C61259801E8F3FD96A83A1AFBFFFA
                                                                                                                                                                                                                                                                                            SHA1:7CC512F180798FB459288AF8C3003054C3ED76E7
                                                                                                                                                                                                                                                                                            SHA-256:3DD6B2E892F8FFC4E4E45CB39DFA82C377F79B1D43ABA02BF9C6909EBFE33F33
                                                                                                                                                                                                                                                                                            SHA-512:6EA3A89133EE1940E4694455771F4A671F8BAEEECB03AA73CCAAECAF69F92A4B4B07D7B549136E10F2CD030D4EB98A7EAB9B7CE0536D20179920C2A7A44E7C5C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XtqD5abLpUYDO2WKA/B5FHVlEVFFMvJ4GLJLCamqcaUQ=........=.+~*?....SL../.....b.(PG.x....3.B..Q3Y...B....V..g..&a#......-b*.Oq.........Zw..4..k.~-Y.......>6a...D..H...}4.N.....GWR.*@hm.>...xr.G..W....=..*zY...JIhJ..q...........0h.....U...(8....]....m...n....w./..tN.n}d.@..../..9.....B..r.....#.r).S.H...o.....@..........N....@w..c...g...}..0...r.a..R...*.....*.P..2S./.r v.2..pFgV}.aD...0.5i...$.Zi....;..!..nGi..1.(...L/...9.......\3Ei<:..^b..]....jz.c.bEr(..-...g.f.r.1.a....8.0k.P...t.B.IS../F0/../&H..cY.>...7r..l*... ....`...p...h.........~..L..S.Kx..&e...M...>oI.....}.w.k....q............T...+..n.g.A...78...k...kH>x...Uc..[..%...K.ls..D3m..J.Bf.H.X..v...N.M..i'.\..)..G..P>....^.../...!M....i>.@".l..ak.e.....}YY...C..._.:.`#...!Cj.h.lg.o..C..&a.&&>B......}X........;.@a....+d..}..IU.&.K7.v.......0$..j...f...".w.wp..U.v....R.^.$.......qD.m@."...A..4G~.. ...;.mp]...8x`M..=.r...#A........PdA.....d.U..p-.....w}I..A..F\..|..#.):.....#

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\33681da7-1eff-455f-bea0-5e592e068940.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):861
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.748150420334884
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7D7DCCCDC4BB6CFCB5DC3AAE04C57F8E
                                                                                                                                                                                                                                                                                            SHA1:96B83ED0AC10B7F800AAC80963A1E2007C4C3311
                                                                                                                                                                                                                                                                                            SHA-256:F6B3E3B7EEFFC3FEA659AB26F31A5239BEC99A34B55542241794C03D445ADA59
                                                                                                                                                                                                                                                                                            SHA-512:33C953E49B61E7A89482D2B55137BFF6D6D32F83E1255D11B9A9A15EE0223DBEC96274A0802A7F663F8C3CC296EDC18FE51EF4C174C2B4E272A7EFF1A1C6FD60
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XyQvReSREhA2aT/x8KVfAsqeZU5abOB8yqqwGNYSZeD0=......w..P.&.x...m.u..s......\.l).#......x<(w..B,@hn.`..6`ti0E2t{oD\.@......@9.......{.V.F.6C.7.ve).~.*r.A;.J2{v...w.....g.&.....T.po.........h.JP.D8...`...!.@.]....B.......3y..x.,<4....r.......#.t..._h&6..$..........`.u...0H.cO..G'..i..../'.d..y.koJ.+i....]..N..G~>.o.8...2.$..!U....;.%}...<)...c...F...eB*H..K92...=0..!........ (#.s........4N...V..-a...o........LR.........H.z/XT..F._.b...&#%....h....|..P..Yg.K....._.R.>.(...}.>...\.f...p...5i...Op..9...g..8@...'...........;..g.|&Kn...C.lu.u...TA....>,.Z.9....C.g....T#..L....N..'l!....o{X.....,... ...eDZ.X....&.v.%#...|..qc.......&..B...A.o.S....V].. ...+....Roh..jG9...P.Ux...l.g.s...`.P'..PjdWJp..J..AZ_...*..O%W........h...WU;..o....Pz..=...^.&....t.....F.>.x.T..W..!}..C.F.q.}...h.../f%....e.e.uZ.0.....>2.O...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\341a9e0f-6929-43a5-864f-b1fdf2163801.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.979061868619168
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C49417F5FFC1B012D570BC5AE2B51BF6
                                                                                                                                                                                                                                                                                            SHA1:63BC14E8317766984FF1BC950FA83C4B42130D36
                                                                                                                                                                                                                                                                                            SHA-256:8F3C55EC0BF228095AAD537C067CF5D58445B887EE49B881E5BDF150638F9BEE
                                                                                                                                                                                                                                                                                            SHA-512:ED1585C9310A36E2D536B51EA2A689C86EE7EE026AEC166839A6C09ED10AC4665A02B993496CE2A6C34BC3B8322F214659E2FD418BDAC611BE8E251AD53AD102
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XAKstPshKB72ngeDRJGT0Pa51Wdzzoxjsbj75Q/S9tC4=.........Nd=9c0u....^...7..(..,.B..U.H..q4......./.@C....k.;7Q..(.|.N.....Kp....` +.......7.k.l....d{.J..........S..&!..Sq3Lf4.....B.U{.5x6%S..`..~E..G........*..a..3uMevV.m.....[.y%.....,.......3.9..,..\.o.j3.8.3.{8.r.b.......!H.MW..."..>...r..e..?y..w.....`..... ......NeL..W.f....y7."..V..\..b.........,.......+:.1ljW.....+.'...}.l%...-...4nx.PT....J.{.%.|.<.E...E...A.q..n....&./...!N.h....X.D....@....|......:E..Q.$...?....WF.w.l.P......i.V.E..i.L......|..I&4.....2..*3*..S2.l>.'.Or.#.....W./...a.Q.t/..$.S..V.)....XJ....{.u.*....bjU.G. .px.C...Z.}..VJ&.$ .....vKI.....S.........Nu0..7cwEF.q...ox'..l......q..`..K.{...3Ad4I,S.o.]/.60..$..(..3......).....u....f.;.Z&...FW]&`]...V~..w.J7.....b.({H.....i+........SUOg......q#...l..........=....'".4...q5..1....~.V:D....3......CK..X..V3g....3....>.Z.@.qu.P...aH%...G*.U.r%.~.G..P..O..-.xP`..$.0H..../kt..>*.m,...~.y&6."..x..`...s8`;............3

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4253bc13-3492-4047-a604-764715b71a91.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.977975187908712
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:1645353E7D494DDB603C20C9CA949792
                                                                                                                                                                                                                                                                                            SHA1:BCEE2B257F4B9307DD757A35ADFE375666B496F7
                                                                                                                                                                                                                                                                                            SHA-256:0AFFE3F42C11898B3269AC469489BFE5544B4E6B2C0408342DF519D7C389703D
                                                                                                                                                                                                                                                                                            SHA-512:0CAE0E20E681EF48681B8BEFB3774C30241198B0EC6F47B8C7DC5ACDDB9AD0F1D5EDA5E69738E209704F1F88BF1BF5B08946F3324B4EEC5A4241156C2F1C48DB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XqKhY+QqKP8dEQsdlIOfBW3hEgdamhXAayjMhl7lwoZw=.........?....C...<C..........#P.e...FO."@.._..D+IAg.....1...,v.^.w..`%q7.Mp7a.).....@l.C..l..Qh...C.y...W...5qg.H...8..6g....C.{ap......{~B.>.W..."2G.+..g.M..B......;.....<.fU.#...`H.g.S.GY....}%!.;.b...#5.FZ....O*.m....g..6..f..O.t....&....h./..4+Dv..."...P.....%..a.....4.9-.=bF.....Wh..z.-.u0|<.?....z.;.K6.K[.?x....q.[...<n.s..U..T.f.f....W.q...w/...-.E\p.6cn.1z.....O...f.;.75.z.h.7.q............j........B'.G.).....yf.T...K.6......Cp.?.uB.y..bU.....TfO..o...hB.zf>.A..T........x..~1.@'p.....A.A...~7. .H8..B....X..L..^....T.w...O....>|.V....\.....TCDP.8+N..(.([..D.../.c!....h..Ag......z>q[.uvf..[A[..e.*....A..g.h,......5k(.....oE+..^..oP...I_..2i.......G...rh.......L.Z....`.!X.D..09F....|..LF@.S....M.M..8.......k.6_PaE...l.r.^~4#..Q...>$E.!Ce=..,]..`.(KZ3[L....w\.hP.....Q......^;..((..&3..<.S.)Aj......o.d.......#p....cyd......^i.PJx...$.M91...\kw........%.0.G5..-.C.F..8.......1..,.k.$...8.C.n

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4258064b-f7bd-42a6-addc-c0451e86f3c3.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7133
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.974890542266276
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0C050D4A26A48A28D202337430657EE6
                                                                                                                                                                                                                                                                                            SHA1:4305EB42976D45DC91C4DFB1587C825731FEFF58
                                                                                                                                                                                                                                                                                            SHA-256:138FE01279D154E88251406D2398F63351B524CCAF2BCCB2E408D667E9E307EB
                                                                                                                                                                                                                                                                                            SHA-512:EA04EAC974F7BC5ED698ACF7BFCAAE9B760723376F38F7F5212C269F82256D9DCD08C2FB1047CCDA5C6C8706A1FFD0D24701B6D4F9343ECCD3169BB9C8C493F5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XFI089MDpMwbBUlfBIMH7KCrJ53n/EQvdu4BnzQyWEPs=.....nn... F..xi.I#u......&...JyU?y..u.)....h..L..."~...1..x...p..T#...;...X%..=..$r...C.+...,s.C."~*.ax...c..'..n....)......4u..e.g..j....6.z.."K.r..2..}}P.k...{.Yi.......C....=...v}l......u$.?*.w.t|~..gcH...X..m.R.G.....P@..!......$.*bA...eP..V..Z..n.......<...?W..LN(..!.Ua..o........dSzZ8|=.t......lt.P.).Z.h!.../(.@27...B.Z..g..Ec....x....3..@..m?.'z..e<...4R."..7&G.,..y...O.iahX4...?....7...Mw.q....;.@..S.8..4x.....l........]......Q....n....Uaz. .{2.\v<...[.4.x..|...0.>.....c..$A-$"...n8...z...F.<?..dhG.?..e.P.@7d......Z. ..=6.1!f..=.[....'.l...5M...X..o....w.9..g..N...;b...z.........YN_...80,Y6..8P..T..X.x..k.dQ].0P...-....E.X.6....*...S. c\...0..SI..v...|N~.....O....7.L....T.oZ.U.*j...G........D&P.;....a.hD..E."..wp.....X.i.G..T.sF..0..2d..........j.uR.`..P.|..\.D.6e.c....0.0.E...|u...`....DU....d.v.... S.._.......c.+....f.gL..k...d.p..w.CB.Wr...^............o....k....Y.R..b...vi.k.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\430e74b3-d027-4c04-9060-52dff3e3f954.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8173
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.975398558794403
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:00EA0FBA245FB06E8129C17134603AD1
                                                                                                                                                                                                                                                                                            SHA1:31BDA4C5B127881C6FFDC61D19F0643DF8761721
                                                                                                                                                                                                                                                                                            SHA-256:B3B454BFED6A930AFB7CB1F3C068D3C3CCF4CE9BB1EC96549FE7DEBE73924C6A
                                                                                                                                                                                                                                                                                            SHA-512:3E6AB80366EF116376950C0C22B75E6C49325DB9741665DF83D52D1B4BA1BCB7591ADE3DC5DEE02C28A69C113D76966AC92D3B89BCE39CCACACB66760A53E0CE
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XxxttWFOk1PaCfI3G4VuH/KBQqDjdgZUKT2nMhE96tEw=.....~e.|^..9.?..`.....LF..+..Q..@n.,...n..C.4......Q...B.....fz.e..q..|.M.g..<.g...S.l .[_9...ik.ms.[..Am.a...F.AD(...."Kn,.d..m......>.;.np{....(0..bV.)H.D..'.a'.d^.........&...h..o...EB..J.fL&..$...\..q.-Jy+..vN.?.:/...7ym.1.}...#..C/W...".WN{.<./..'.^....B(.4.u...]H...`q..R...I.!i.Y!R.G..^.w.............#.....D|..r..........U.......`...L.........FCN.Q(,.{.q@\.:.Qi..o5.#.(.~..Ca.........^.#ON\...H..).C.$B.d..,.l2y.k....*.ur........N8X..He.....?w...x...NKAK....M.#.{.3W..Hl...G,9Z..e..R...W..O.x. ..5sF...P.F...e...-{R.s...X..q.... ...z7?E..$)e..M.=.yP.7..I..U/.;$..L]>R......k..e.;_.`M.8.\.{...35.....`..S...f.T ....v7(..E.0..V..../.V8c...&r<~../*Q.k..\.W....!..t....fi...h3...8...4..m..r..LU.... jNq...k..."....r.y....-..Ju.1.>j&u.r.........1..F.["...p...$.}....-~....`2...|.D7sW....O,.. ..f2f.'9o.......%.T.^.o..W..2A .f.-.../> .4......j]....9...p.dF_....K..>L......`.U..:a3.5{.eP..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\44b65c5b-dc1f-41c1-9172-6519f86391d6.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7373
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.973109320404117
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CD4DF6503C00D0EEE3D44C7CC6D015DC
                                                                                                                                                                                                                                                                                            SHA1:5A0ECC61039351E470E134529ACACC5C9AA20486
                                                                                                                                                                                                                                                                                            SHA-256:8544D10FB3F95DA2C2D6210FECFD2E22036AB5A9C7525BF82EC2FED534BE0782
                                                                                                                                                                                                                                                                                            SHA-512:C8CC0C9199F2500A6CEA1CD2881B40B791FB818E887903D4EF64D6A274BFCA86CF87A7A07E6FFD1982A2624CDFC2BEB3E183F1AC52E05754DF5EA79BFD11C00B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XMnrNXTeVDO4Uw1whdcJrVgA57Uadu3aPNrbo4L1xM+Y=.....rM....).SN<..?. ..qcfv.S}.....R....;.TJ........0.5<..NHPn.|......V...$P>T...6.bs^...s3..8"....1...My$:.Z.........`.0{.E.Zh....!....@.A..xxNE..5.*..*.zlX.Dy.]..?..C..9....K...A.l...}Z ..Zj<=.d....8..J.5c.+g..+...Q..m2.P...x.s.y........u. .....C..P*..7...Q/.S[.}I7i......x".....+3u..]...:.....v.r.F#".}<..azz....\U..-+.bi.,..YX...fj..$.>..S-e..a....9.k.DY.z.K.........)..Y....=.....ku.o..j3...S.M..}...6}o.l.|*....._.{[....F.Y.ln.....-.....KpT.K"...g..4i........j..u.....H...,.AY+.....?..y..........<|u...h.-F.V...x..[...j|....0.......c..S.}8........#. X.*I.:.....J.....J..G.'."v..X...~O6xFS.WtZ.....N!\6.Z.Nu..O:...(.v,^.......`...8......Ce._..S...v[.y...1Qs.E...c..i....... ........C......!(IZ....W...)...F.........SoA...c.,...X.@.3.xK.X*./.N*d...9..C...%..,...\./$........KD../.k...V.U...H...."Q.....s..u..........rK...\.....}.<.|-G...2..`........w.}R.W.q.~'A.7....{..pi.|.M.4n<..M......u.g0...^..b

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\450e4ced-721d-48dc-894c-c531dc74437e.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7277
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.975548118229001
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EBA653FE6DB3FF1EC79E4974720D89B7
                                                                                                                                                                                                                                                                                            SHA1:D871F05F2CC6754B8A3857BAE8F04A330E538947
                                                                                                                                                                                                                                                                                            SHA-256:88F733E627919DFACC944E44B0C8A4D56356E77379B9AF6F6C880C85F6271280
                                                                                                                                                                                                                                                                                            SHA-512:14AFFE75212B2C337D6C7BAADDDC190FF5DB8940BE6A90AAAECD785ECF19416D362B9D5107B9F180404DF2FDE8ACEBD746B2A13ABC10AEC54EBE3D7D92172041
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X/5bTm+XFSDY80KKBEYszViCzzB885sXJJ0Da5i2tE24=.....p\3n.>..:..,.......)......._^.!g....:.#.G4..1..........N....\.....I #@9H^V..@.+......G.....@...%.2^..(..w..M`a5...U.....p..H'.Au%.7.}..Yx...XQ...s..e.J.n.k...DJ9.:.....6..R..QT.{#..c!.....$)b./:8...s@...F.D....._.1...b..onpy.^2....%..VMi.|.!.P.x9.Q....$r3V..J.-......Z.a%..T........}.J..N.:sD....yT.....T....W#A...FFqo.........k...\..' .q.H.....|......_...."..C..-.B.&'.."..b8:Y...~....a1T3.......c]....EJ3..&.....<E..|...PR..,ENb.{..F..R1.4$....P.Wf..-........<..x..0._........;.xj.....O.[...W?rW.E..p(.".*....h.n>...D.E/F..Z..S...Q....v .I....}%..n...g..;.W$.....$...).{);/y.yE6:]2%a.4./..;ph.+o.35.`.)k.v......E.YN..ZD9.j..V+..3..E....&9.y|..%.Hl7}l..k$.=%...l?..Y.]......3...Y.4x8j.p..Q.v.f.._...(.l......t.a....N.n..j.\..*..^.0..G........g.ic=.0q...u.(|^aw...+8.."...J.y..t."Z.}O.|#h.8u.P...a.....Ym.C......)-..3.....C...........S..8%..t...Rq0......o.....Wn ...f0w.h....._...`..K..IX?.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\48118dd3-0b64-443f-9c6e-c7af141780f6.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.978172915963462
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:3763E6F4484CD3D089AE62737EEEE59D
                                                                                                                                                                                                                                                                                            SHA1:39BDACA0CEF150F5724AA2CCAA953AECCB28CD2A
                                                                                                                                                                                                                                                                                            SHA-256:5ED08AE6F76E13C3F720EB4772F020D09A5F27F170994F199D0D8092E667DD39
                                                                                                                                                                                                                                                                                            SHA-512:2D02E73E243007EED5E36711A25CDAE86F9C026F699E6DAC6B60C4E2593FD2F26CF36A76259B0C5B97D80C1F3606D1422F94D50B58819C55169C72D8BB788C96
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xp7ePdbhw7qQxSvHoZVi7OwahN7n6oA/M8JeTM3BAAJA=...........*u...%?.:S.....!.\.z.h.Ta..L..{cM.......U1B.]..H...#%....U....]u..#.^...=..{.....*..+JG..{t.....I..........2..hhKg....J`(......3... .W..#.Z...7+;+...\/..e..zI..nR=._...$.Tto..ix~.I.O..>..r.W...95.. .r(..........Y:....Y.....A....!.&.*..6 ..9a.h.+P......UP!(-..]t..|Z.........S0C.......1...S!..5.&..._ ?x(..<............(.T,....f....^.|.!.~...b/...!.d....7... >.Kp.PI.........;.{.Q|....;..F....t.f^.8.$..S1..H....o."f.7.u..K<...O.....r......M....N.q...Gd.'E.K.......+...../...4.o.<.Q...l>O.6.xn`..%....9Q..?.......v.UKv..y.}..j_.......:.5...2f.7Lx|k..f.u....d...p.0...8...^.....w..}f..XS.P..q.Hy&d\.......i.....z.....Z7.l..VuB..._....!j.s..e....{.L.......b.'..F...E..a1........p~X..8.Tz@.jp'W..k..x....HcR...S.(..UzY,.`......&T.D....sW$.g..R.mm6.k..%+.?.{2....X.6..[....V~..W...+%...X."*...l....p.E.5.D>.^.E^.-K...4..7d...r..._...L.p..ez.*9..F...z..n...M?f.vY......rr.-U....R...$,:.T.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\49217796-d21c-48a9-8178-1775ae02b110.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1085
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.837870522039655
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8336A4776662D83365AB32710AF8F774
                                                                                                                                                                                                                                                                                            SHA1:484E36194054BB719A48F4FF60ABCDEE6C4FF970
                                                                                                                                                                                                                                                                                            SHA-256:41E2B006CA34CD871C8D611A18AD024DA60AF3B26F7F1F1E8C52C45242A44937
                                                                                                                                                                                                                                                                                            SHA-512:03D354AF850D2D7A02A57F7224DF3907561AD5B30C5FEF46DD800CE9D83B69EADD2BCDFC28286E5695B5D6A8B436D8B2109C94C05F1338421A0DC84C092C7D24
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XqjlyvebwBCx1PlYjUPreyQNaHxtn2/4DMpLo9vn7J3s=......do..|...p.ez.i...}A.v.`.}!d....?`.*......O..U{.PJA..h4.....C.B._E...!m.+..8.M....l73.q..;..LX.3...........[..Z....{.|!x,..&j...+.%..o.$.....7f...kR..u.y....A..(.lj.......JpX..<.*y..."...p..p...mo..=|.v.qf.&).D...\T....*L.M...<^U..H../O}..R(.WJP..r`.~.....=..\...P:\6(...?/.e.0.(R.p.95C..=G.T$.q1j..{..!p.....\.z'($\.6..O.C.9.JQ.C. ...4$.L..-..M...s.t.=k.b3..6.......P!.&.W)..E=.(...>w+..7.....O5..%.#...2S..X...'O.c..>.f?5........f..V...K..!....!.M...E...'.`...8..4.r....4...vS.x.Hj....w.....,]l........o..#.m.^...x...J..%.._...w...dO...$.F.&.YJ.=$J....$......"..f.....&.. .xI...|q...FGP..B..M..x..@R%+...=..i..i.........oj......."....=t..I.!-.. .Vn..^n..Aw.?U.........X...S...D7.T....|...2........0[..d..B...d'F.dI83a[.....vs..=.Jh..N_.1 ...C.-.CZ.u....E..;.3..w.^...t_....wQ.7.L.........7P!Z.....}...{............h.+..2.1'.....u. .TYy..6o......4.j.7.1.d.]p....8.....(\^n......up..I...;.....I.Y....@...^

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4ba17ccf-6195-423f-8da4-643479c4f02a.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8061
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.974200321818952
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D3FA00252CB0C0D3C83C42226221747C
                                                                                                                                                                                                                                                                                            SHA1:162C34230B076A81CE5F4ACF1AA11E94DD373264
                                                                                                                                                                                                                                                                                            SHA-256:7A214487345E759946EED3BD1D07D7830B321D5296F026DF6DC40E7C38193405
                                                                                                                                                                                                                                                                                            SHA-512:829E03C46905BC6C82E647BCFB022902090ACAF8E3E8A94165928262E8F73C8F6FFBAC15BDFBE346700E69E93411A13FE8130C801CACFD46DC39A3DD3C887DE7
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xy9SOjC5yoe2wERzHuDnuif84L5Ot2dQhVNhOCrVAIpg=.....}...<.ty.I$z. g...W.,.@?u[..2.Z..S......B.`...v.zia..S....8.3..."...D...[.M..k.?D............n..EK.!X.L.x`I..ei...+..L..$.......e.6.5DQ.;....h......)P-...OU9...~..`2e.=..@x....k....y...|h.1m..6.3.W...#..?...1.-..=..<.%.V.U..+....(o.7.s?{V8LG..._..I...D..........k........,....#[..<..|.-...s..'...p!.....,.....N".4J0.*evr`a.C.Q.B.C<...?v.<z7..(.Bm.....U.9Z.b.=.z,....k....&...s.IZ..Z.}..p...I$Z..?.;....AD..x4.4i........R-(Y.7'VX.^.s.$a...jA..p.5{......mkF/..G......n..Y...d....T.#=.s..'..5.E.d.E......g...h.#v..o.I..eG.T.nQ..w.x.L6Y.'.+YQ...............pR.j8..[.6e.q."1.....Q...Z5....?2..:.;./1.......n.~..H.bo..#._2..S.Y....R....{I..v0U...K....[S..6..9./...U..k..D..........C...<C.......]..[HAj....._.{g.....RCD<c.i`...Y...A.9S..LE.3t.W.C8,.q0..K9.l i.....*..G...{.......D..HG}.1..vbQ...... $~.P.D.. .y.Wr'D....+......hG.$`zT.9...s*#u..I....}...b..5K.U.......b.S'....v.0wd}...Yn....H..f.C.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4e2b71e7-3f5b-4271-9252-2f70cb74bedb.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2269
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.902846321646376
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0B617B11B0035AA6D1D2A453C973E817
                                                                                                                                                                                                                                                                                            SHA1:E393FACCCA68481486B4A691FEBDBA76227D8E8A
                                                                                                                                                                                                                                                                                            SHA-256:5D1099F5A63BD5890F44ACC34FF10A5CE573AB7F1A429477B243A6806E473DA3
                                                                                                                                                                                                                                                                                            SHA-512:E401A226AD2D61969F677179E1460E193CA4699E3085E9C5084F400865867873D1A4F8295A281EBA3FDA3022FF2BF60932FDC0FD2D599392800F73A89080B424
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XmiCvkDEVCx3QhKn28ATDnSSS2eU69nJwlBFGiSgxPhQ=.....".G.........s(../*...1.*[.V...S...Q.8....../......h.w...d.G..M.6`..;v.(...{.!.F<.Y.8wK.......T.?...K.ucC.....'GVL,...:\.0.z.....`... n.*..I.@`.X_x......../+.=.5..d.g..Aq.j_fo.....}.x.2...}..Tr.I....\-..4q..GH...n${..=...DT..w.S.Y.f....|(.^:..Tf.b.../...]e..9'..F.7jCc.FV..,.@8J...64...h.4.a-M0..<{...~f.R..T..lY..\.R..HR.NX*"._....\/.[.$<..5...O...b..B....y......RbP...m.<.H..?...<. R.]m.\-i'M.7..J...:>..|.q..k..4.4o.&....tJ...-.$.fY.....L....M,...,..$4.:.FB.L\.Rg...p....s.W.....j.3....7"@.P..<f....+..K..xIi.......Y..VhL.$ejC$.....%..._(..........O....]^.C.^...m./P..u.%.7..QL.............V.<'.M..d..%]..<~.....*s:..U..=ML..V.k2=...w.._...mdIL.. l$........n..xJ@..Y.h.,`.v.J...U.c..S.. ./......X.9...A.K-s.TTH...G....z...'..M...#}Z...1..\.T..$.......*../.H.?..N..}g~.B)...+...n.V^nEx.@J..>...=. ..@K..A..[.......3.l..-..!.I...1..l..Wj./..s..aqL..!..h....5j.e2.>.m..&.X.+K..c.a.'W.j)...ZE

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\5275e44c-595f-49b0-af62-3e91e0d1196a.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1581
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.877274889642505
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4A0ED4FBAC447467A34950CD50F70254
                                                                                                                                                                                                                                                                                            SHA1:35B4DF45111B2B6901E8097FB4D55B10803100BF
                                                                                                                                                                                                                                                                                            SHA-256:0D62F8D9E4C59639398C8A77602150B5B6D72BADF5936C69A406A1DF6A81FF0E
                                                                                                                                                                                                                                                                                            SHA-512:5D686E805649C2C4640AC29F609B7A8732559B4D1D8051FEBF720F371C5F1C579601DB66D8ADDBFCE313133D8A74E3943CF93F2F289AE68A76E813ACF6F65FA8
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X21N559xIREVIN09b9+P93dhvr8wK/dnMqswQctsxUFE=........$\.f.U[....J.}..#K...(/ZCZ'.`..S......YB..=.=..P...7-...!....%...2@.\I.o......R...S.-.@+....k..e.?3..D.\.t^.q.hZ.@}.,..P......./%...D...E...z_...#.1..>.V....r..........H..e.yVa...0~.lis...p].U.l.. ..._..$8....X.5...3.m.......@....k....5.z......2.G..#..(....y./.0R*...2._..nh.. ..X{.;.8m^....p.q..q......z.F.......y9......;....J.. .I.....T...0.R..t...V...t.H.4.{.I......W..2.$.!...x..........x.....&%#..&.[......g|@J.H.4..Z.9..*....#`.$$.Th.uK......ZG.j.|....N......}.V....!....s.$....-`i(..~p.6..b?...C3...v.&.:@.......9.r+.L..v.....F5`..M.3........mXG.G.aC......k...$ ......B.......N2l...........'.....l.{,h..`;....4...Yw5_.A..a.z....D..#...e...}...6Z..O.._3.|...T...4n...f....t.^..aC...n...Q.?.6..?KK..0.#.....z.:".<...$n..@>.+.ZM.L}.%8d).R.ek.e......U.^..5g.9.k..n.I...YU.?.p........)r).&Ga.D..\.c.yc....%.f../5.Y.^.B.=1.t7....b.^c..?....._KZG.3..{JG.j..~....4.....A.ei..2W..k..^.H.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\5280eae9-3899-4bb3-987a-e2e2a5ef62ed.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.979527719537053
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:ABCDA98B56DF456B79D8CDC4C400260C
                                                                                                                                                                                                                                                                                            SHA1:350CCB2C3A5E67C50B416C713914906670D6FCDB
                                                                                                                                                                                                                                                                                            SHA-256:5939659C8162F20800D31CC43204ECDC3060D34AF96DB03AB60D02060C96FE12
                                                                                                                                                                                                                                                                                            SHA-512:F24E69888D7568887C75D18E17CE1D6356A26F2C41C8D729503D3CA945E5B1D863F822B9D495E833182BB380D4875460947A3012BFBBB3830BDEE6C5F9B3A6A5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X29hXcfUyxYYmWtmfKjGqFxk2YpOZ0Ub7P8OQ+Gada3o=........fh....&&........BM..T.p...;.U.J....S.=...U..7?...{y)...\Er1.J/.3.4iU.....;l3......^s.kA..8..Q.N...FL&..HH#.XO4.oD....j...s...Xcp..K..g.fu....9a.a...Z......V.gA.d.......ZCx qc.F./.....:..+....T.LQ..z..q....N.PZ2.t..0gV.F....c..5..[....`.6d.4...Q?...M.t..w......g.2.12v.i..i.V*.../../.H/..Dv...\.. ...Tk.......3AI.E......%.~.-...,qmu`I.&^\J....r).8..J....=P.`.L..t...BD(...sl..`...a..$^..U.H*....gnFi...y.5]K....>..w..Y..-.p..Z+"b..Ge...d....L.. m..C9V.J..;o.h.....OPo..Lt.....=...%.c.*....vy..:o...#1..p-._.$.....g.k7..D"...!..c....<..Y9..)r...B./,6.tJ.].B@j..}..mkO...}..:k......v..:)g*/9..AHv..8...y........<Tl....i...B.nf..lo..I..-..&...MT....V...,.@.K./.D.H.....`....Z.F.?./i.j..D.mg....qz............d.T..1..NV...c..o..d..e....SF....2o.Q.?..E...I....>1.....O._."%7.H,.o..Ev......r..T(nF....L)F.'...w>G_.e....'.C....j..ZgE.f..U...yGm.._..gl.iv...d..].UW.+HW.9.vx...q..AW...4r.R.I...b.!..q.8Z

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\6c3f99a7-6e14-44fe-b17c-989226504e61.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7501
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.9764640586566635
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CE24C609405080059E42A8268967D72F
                                                                                                                                                                                                                                                                                            SHA1:B8EB22987D13700A7624AF6B3574DED0BD07CFA2
                                                                                                                                                                                                                                                                                            SHA-256:33E078E00658ADEE8D6E42FBA82E5A98E5E806F9BD67C613196355B726A5EC2A
                                                                                                                                                                                                                                                                                            SHA-512:60E4592B46BB9D86761A706726BBCB23F6C08FAD565ACE4C61ECAC9F94187507079204619ACAD9B99E6998B969A6B50D068376390BF45036F2C179238415B751
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X+lAkEigNkpCQjV/dJ9RIqzD75uMI8WOYdCN/F67EZec=.....t......U.W.n.....;.S......u.y.[.m.:....@3%_.....g.:.1....r{$n....6\....x..W..&zN.^...!._j8.Y..(.q."..#.]`.<A.}E.......4.cu..L.e.s<..%}.%..pB.bS.....h..X.D.<..U....q...a......<*..Ze........(.~]...|U.c..+..{zL$...........J..V.-......F... .....ny.P5.E(.B?.x.8;..9.............r1.n. .U.....6.}...Y{..(B..#X.^..M..L.....m:.G.%<d.....T.?:.%..|a....9.s....r.._q..[.2R...%.........Q.d7..pXB...nU]iN&kT.)......t;.I$..B.N....8.....e..:.9.H%<.....-....,..x:PZ7...Q...d'....y.Q=...u..K.X..`...t.A.a......H\........-...^{.....;.a.............MU<..XxZ....a...zz....?[...;{..\e.T.x..(..U.~}v..b}..-....<..]..........I....!...m.AB.%z....K".X<...k1_.V]......%;..V@....Q.h,A{.6c..Hj.!....*.R.G..+f.{...T.c8.).Q.H......f._^.W.C..Akp...I.O..n. ,.....\B.T...C.....I.a..:...6..0u.).N;0..EK...l..l.$......qV....e./...~.S.....g.m..8A+Dp..2..r.......)...).x..@.....0.;....8R.....1.. D.1....[m;K.<...d7....%!..p[*....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\6c96266e-97b8-40c7-a5d5-41cd1a1c9e40.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7325
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.973530635548828
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:070B4BA7ABB7F699E8C55BF26507EFBA
                                                                                                                                                                                                                                                                                            SHA1:5CE7D2DD00CAB8F1CFADA700AB6733455D2AB657
                                                                                                                                                                                                                                                                                            SHA-256:16478040D3BAEC6DDE826E5A21925B2D11B0EFFBEFE0512785F02722E00E4104
                                                                                                                                                                                                                                                                                            SHA-512:5037853EBE74C10064F48738027B47FB5FACFFE9B2E4AC6F02A7C18563B72D3F32A2631344BE58A86CB6BBE47F9A6EC542DD826BA8F0B3E27410BA0A711489E3
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XRCXtedqs84nWmH5Wqc4uVIZAwtVX6lEXWGy/CzPe7ls=.....q4.F.B.t.g...~...a....o.X.L....K.....,R]_9.4..R&.D..J......$.\..F*.Kf......B.UM..h.....g3p..(.>.z...`T..Z...'.$..>...~oC.0.s.9Sh77.%f.I.,..BFc.rik.....n..1._b.q..Y.../.6.t.....[..~p.WbU....c.k..2.C..dV...8z,d.._C..}...z.......;...6.....K.S....|.-.X.0.z.K./|..u..<....~.......D..T^/.<.}.Obo..."......A.f.nqF.......0....-...VI.....:|..._.BP.4...h...G|....z.4Ui.b|..tl.z.{.A._..0.{S+.R.'c...-.Y..."*K.......Q!....-xB..-...6._.Vk.A.a.....>.....R...N....cn..C.......Sq.#..T.Ejx9...jw.6..\Mor...p....4.F...Z1.]y.v....:|5I..N.R{.+........KTf......?0><t.K..s4...p.9B.<...w...b.Z\..A.oa......k..0.-...Evu*....M{tD;......v......., .y..Z#.b..B:jc.(.%.....s..1'Srf..+....{..^p.....0...M!.....Cw...[5.....zC.Nm..Y?Co..4A\..C.U....Ab.3.kNu...8)....Hp....a..:. 63...a.N...X.S.9*..z.H..\.......7.N..a(......\a..b}!t.wK=B....m.or.I.g...^.&4.S......L.s.....$...".&,......V.B3O....H,..pbZ..-(..Z.r.2&.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\6d640675-567f-40d9-96fa-3ea7e0dde602.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7229
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.971375521249308
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:158028A91334725ED85E8EED7396F6A7
                                                                                                                                                                                                                                                                                            SHA1:79EEE802A2A6484274B626DAB50C33D17191C42B
                                                                                                                                                                                                                                                                                            SHA-256:10B8CF5B7BEF5DB81321F6091DDD81193810FD30BD901F2302527290482321BE
                                                                                                                                                                                                                                                                                            SHA-512:76609C58957137897CB1B6768A9420B3A371A9FFCEA3D0384286FAAD85351329AC3AC4818957146D6FD8A8A170AF5304DA071B913DFE1C6ACC2CB17D0D46BF2D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XjFaqzo0hI0LpXQMKvhFa9ExtSRCW5BorzZ4dLLLK0fc=.....p.......b...@C.S....X..V.Y7%....j.U..5.JQ.v!"..,by....A.n@. .}(..,.Z.;....V.....@.Er...'.|4.o.w.J.|O.?!..U.9#..o.!;....3...R.....".........[d;.JX...!s...M<.9.H.].r....M.7j..tO/....}.`._...>...S......K.sq...?X..3.......S.^UR...Y.7.,[.o.Y\.|=d..{..)......x..K..I)..5.M.....+.=.....-.E]..p.....ti..\.)Il.E....B&........x.Q.1.G_...s....3[.X5\.5...E..c..... X...P.zv:^..`4.L.".....vQ...yos[.........>.....O.d....7.9.;<.K..b..[\.DO].6.......<4.Kt.U....|W..+...*...2o{uU...5..).P....H*h=.4U....v..r.c.K........j..E.T..t..R$6J..1.ng.Yt... /K.$.zA.'..-x.2...8..^k...=00...i...'.h(.Qf.l..[.x.N..C6_>.44.h..$.(F...~O...9!s.L....{..O'..,`....lm:.....4X.T.......z.....\.-...@..1..........B.U...UVk$....*.^h...}u..@...c[.......!0N`B...o..P<.N.2.a=..jY..Cg..QJX.(.........u..5......|.<e..R...,..FIu[.......].....p2.lvn.?..q.e....s..Z....&...?O....6.{..'I.I....I.N.-cd.Ja........:.<..B..r..=..T..7..0..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\729f5cc2-b6f6-43a2-aa5d-356d4da5ac50.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8478
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.9791253778894635
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C42382566146CF58FB956A2A3263AD36
                                                                                                                                                                                                                                                                                            SHA1:60C30F6BD15CA8576140616BE30031C205DFAF56
                                                                                                                                                                                                                                                                                            SHA-256:3F3B6A9CEE9A2811B89D97BD7E3B56758066C02EE0FD5B45CC3B8782207C9B2B
                                                                                                                                                                                                                                                                                            SHA-512:676C01D2043A9830706959724A337931EA44035E65E2BFA2FF73D2C8FEF77C5373DB704D8018FD6C6D8D1506464D8831578B23C3CA9B1317C8100E41B4A56A8C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X58oQ3Bsdf9V3Y+hYGUEJvqUqqPsvokl92FKfKkCovE0=.......J..........W2N.3:.9Q...%..&.......Q..`e......&h..k....v....>.......".G........vV.s....}....C6.......n.......).V@..iq..$.r....+...4...O|.}rk..4........]4..Z...-..=......,.....0}..b..x..4.Q.[.n.e.`5.....V3...I.W#C.6n.....{..Q....L.y.6Qy.cvk~9.].....C]y...+=3l.4*...s.........=..X.....U...|p.yOj...FB^.`..:..f..o(A...........%.FV..VY..f*......e......4.n..DE.BW.1L...%.I....A..T. h.....c..:~...OFt....9.dVQ...0]...8.|...^g.....8.{O.....'..hn@......o..Ve@`fcoM..gL\.KN....zb^|>...V.&../i+Me..Gx....cm...f9.5.4s.."...V\m...nY.M.c...../i.....kyR..#........!......tD....B.!......n.=*`{...._Z..V._?`|m..c....T.o.){....+.j0.......i....y.....G .hO-{.E..J.^h2.>{f......`..bO.n.}....i.R...!5.pEm}...yQw.+.'.K...~.F....MB.} m.tL.g...2.S...R..Z..E.VK..]_<.,..+1U..Q\...S..I...}../.N.v.N$E..T+...'....Pjz..=[....T~..........<./y.5....P..d\...>...C...</..aF.`..[......W..W..j....)..K....Fe}.}.Y.s..!.....Y

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\7a1bfc81-9dfd-4026-bb73-481859d7e70f.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.976806321077924
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:FAECE9FBE78659DDE708362FA14351BD
                                                                                                                                                                                                                                                                                            SHA1:2D014A627C3A2CB87DCC9CC736DC49EE27D3CE1B
                                                                                                                                                                                                                                                                                            SHA-256:18B4DBFDE1B4F53C6F28F7CDD991806E4CC302520D29B8F40C409FA8038984D4
                                                                                                                                                                                                                                                                                            SHA-512:C65119A1C981927F65484C5F37DC35CC606C76EBC184623D6CC9E0DC44950AA691E6244E2055E6495F283493F36C146A143CA9B00791B5D19D01B7968ADA29DD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XiWwUpP58tiZtcqpO1nMsZ7i8RD93LEqpBsXi9o+OjSM=........[...?!-..w.T.. . ......T.....XW^..7...>......q....7....0..S..\.@.#=....$`.f/S...Fv..*...A.h.......*U.7.h:..H...E.......RxE....\..K..wF.........0....r!.}../.eq-.i*.p.[.N...+...R8>..A.....{LYW.g=|p.....s..t..KRZ./..k...}....I.~.I..s..].U.p.kFI.V..Z.D..#Rj~[~@qU.....[-..x....a7).H..?}:8=....&.|e,}..?.xOpARxG..F.`....d.(.C......2%.,..a...]...5....,.%...........8I......qu...|_.Q..^.........,.rW;..........w.&.F..j....9.....'..t...1....v_7%[1E".y..[]he...r ...=4.. <..!5.E0a..!.NM..($..D..U..nIxC.8g.N.n`1..).....?d.#.l.].n.c&...6.{..Ce.N.zz....q....2.......MGH....J;...JW&...?N<..R.{Fs~.....y...Y.....tx......O..^.Pp6..ZW.$..^0.....QD.Q.......n.....Z.....5~...l...88H...Lz.>.;....$...a...6.....?.6F..mt.PH..k.C......"..n..9.V...R...-.Y.@x.E.._.A%..........H.)E,..,0.T`...m..3.....w..x.t4E.".........S.....)..7IG..n8......~..c.....6.f..}<m.>`..`...k...%...i?.\...`o..O..S..2...0!=..ky.8

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\7a60390a-e4e5-4280-a696-12999037bacf.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.976286889634708
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7184510A9D5BA508FC7068BFA1E768F8
                                                                                                                                                                                                                                                                                            SHA1:113EC3C3AE9491D710E4E7E330B1EFC3D6411724
                                                                                                                                                                                                                                                                                            SHA-256:1E923D1F2FB66A9595E2CABB68D90DAA05326CEBB637CA2C1B340BA8D9D701C9
                                                                                                                                                                                                                                                                                            SHA-512:8925F122A9ADCB9BDD4CF77C32DA919461BCC8F64190DFB32FCA670BB8E16AC127AE1243DA3161813A9677C342AA7AA3772CDC39903F700BFA468A97EF968E87
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X0uitxNPvCw2NuHL1frr//+a9JG/i6EaYSHgRQj4lk9A=........s.e.X&Y ....n..8.Oc+pE.Q~b...Y.?.$.[.A...=./..`J......1..:.W.#.7j...]..&{....J.7Y.`B..;..x|!EU2..}O.o-.O...../:........}U.a..(.....;.....9......?.M..)..?c..I.v.%..1....C...)..k..N.......~.)......l.R-.+a....%8)^`%?.........C0P...VR:....f....]..../...i....>~..\.J..`.(..m.....?..g..l2&._....M...0...VK.2.wd..+...[.'%......O.1..!8%....@>.}..... WN..N'5..artS..^|^.5p..3.3.6...5...w:$..C....w..R.>....9y.....r-..88.4.,.}ph.P.+..6_Z.d..H.;.=./.,.q....L.....q.tJ|+.E..O.ts.....S..h.nQiL]..?.8u..EwS.U..[4..*...^.+...g.o..q=?..B.../V`2..<<._.*6..K]..2s.....K..m.~...9.....uT..9....Rue....6...n,/'......z.`..B......e.C.QGv5Lx2).Hz....^.r~!9.{[~.R...l..F..J...B.@...6.../...>Ka...iSS.j.........Sr>......?...Ml...}.8'._Q.A..S..b.S.u&...h.&h...T....=|}....=...e7;.{.J.U......b..65~.'..=...Z...2.,1.....F...N...V...'..P3..d7......'..1./........U.a....g^.Op.'....r.a4h...E.c>.{zs.n.w.B..~.N.@....A...t.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\7a7f5eea-0102-44e3-ae6a-7034c878d061.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7597
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.972587293924048
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:BB6211E45059667608DAE055C8833E51
                                                                                                                                                                                                                                                                                            SHA1:28AEBF7BC7A6EEE97CBB4B75095F503FA35EC0EC
                                                                                                                                                                                                                                                                                            SHA-256:344814D8204B1E5B5B65CA9E932A3E91A163B29B50051FA2ED476E40A8768F12
                                                                                                                                                                                                                                                                                            SHA-512:2D7536C36F20BEF1EE0C5D84695D178041EE81B948ED1BAFCF9000762233438C26C6E99F3AAAB5C5E3537CD708268ECD53F6CCEB84E3CFAA7506258C86D2D62D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XVdOG7bxTACC3mheWw2L0uaTH5j9raw9RlNYGaoyCVsQ=.....u.......U=.........uQ...?.N..K....<.;.....pW.a.\.5f.Z.V..M1.;......3J.._..nO?)`."....!....._.!."."dfZ.F.... ^5........;.X..>.MM.).F....:.>XW.?...n.N./WC......W.7...$...4.=5.!.o.. ...\..?..o.......W.H..J`~\....t.e.W7bX....7P....c./..j0...tK.....r..C....^..^.h...{o.z..C....h`.H.....`zF.....I.....s.Vg.U.......b..n$ .5..r&......(._.l..`.-@....wW./v...?S..(.......8..A...Q.........xV:.3..T..h...7..m...Z.''6.......XL.F.t...7.^..f(m@W.....=h..B....T.....2.[....I.w.._..>_>y<.E...a.e1&.....D...6...7p....z."........]\R......U...P..........<.G...A/o.nC.I%A..:.K..Gu._..D..7... 1[p@.m.tv.2...X=.........uG....$.....N.X.g@...H.e.Y.......I..K...wZ.A..U:.....n..X=.....L..._U.@s:........i...!1u?t....H8|!...a.a.tk(..'....0.D....P....c..mH5..9F.t&....."-.J.!@M2u.."]..](R..:q....$..........jey...&.(".......v.^.S.%...7..7...OF.N..;...~.m.#.R*..z..L-Y.g...2.....f-"fz:6.'....i/|#.3..L..X(...W^6.R...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\84487726-f2c4-4316-8cd3-317cf8971fa6.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2157
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.9212029905967904
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6388674078D17BBE29B8B23B69422AC2
                                                                                                                                                                                                                                                                                            SHA1:C2E41D0AD146B2669BFAD18E0B14840E64F93B1C
                                                                                                                                                                                                                                                                                            SHA-256:A99DC5626BDC98181945C1BE03B3BEEC9E9CAAFB3A234287C42314B28AD41D7A
                                                                                                                                                                                                                                                                                            SHA-512:8C0C248AA3037B4E2F66BA074DDC46BB2A11C3A9536B4A2270C676494D204387EF654B6A55505931DE34AAB057F640F0766D1579210E1E66E3E115A24BBADC85
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xn6RFEpDcIobsltPqtHYyj3gbaXjLphHw+k/Ti41zDv8=..... ..L....8.-.d}q..I...t@....S)..OV..Z.........kq........=..r3f#G..8 eD...k.]...fj.B...r.k.......S.q.........G...Q3....$...f9.E.~.>t<b..[...`..<......Y.d..l<.E?h....n...XR....~.Q9....k....*.bq.S.2?..w|?G..(.)..U..V...bf.wi ./i.Xs)40.....8...)d...nf.....%.0..~:.O..(V..*T...B-g......L..i....d.:B.:~.!$%..[.t.?t...4...!..d.Z.?.b....2..1L.L.x..2!V...h%i.7\2.......\wU.r+2..vT...I.%|..Y.........R.9One....R_o...BL......".`..r"../m..y./3h....."..T]I.G..&.....2S...j.i1.^.k..G.6j..K.J..M.P.......".P.p7V......|...........9..i*..a.O.r.N.V*..#XA.v..+....S...|...'.X2H....V.d.\..y0.#.@..b.E.a.:.!..s..5...f.<....o.Fa.....7.j..j.3.........{.v..;.l..W..............g.~4..v...|...Z.......Q.&...^..oC2..Q.DJc..[.|..z6B.E|>...dZ...%..3_.gR....5.......qz....y..R....\....?......c;.M.8..4..U)B.w.#...:P}.....S...p.A...|(zle.'.*.}F.I..m..9.a.$.,CdO..".....}...K.t..N..Y...q.a..P....2..RWkH...........c/F.K.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\85f76448-cfac-4191-8da1-231cb34a5a36.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7181
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.976633358549508
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:AF681A6C954D68C0B8BB110C2F4B45D6
                                                                                                                                                                                                                                                                                            SHA1:7184DDCB4303AED2F14EFD4722C43AFD4CD24610
                                                                                                                                                                                                                                                                                            SHA-256:DFFE93118E10EFA11100465499B606D71510F3E108C03E31E5840DF4F641FC85
                                                                                                                                                                                                                                                                                            SHA-512:F373385BC0D7CFE01FC486D0C2042D38891FAE95EF378278CA5D95AD9223B1DA2B8ED3C73ED75F22CE76F57BBB5DD1D6C932867D2B44F5AF295B72469D6DEA55
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XMh3FBwa0SYGSHvMqR+XHi3qWkCN6Tg9i+uh7Dt6aXuI=.....o=.:n.*p...IT\.>...#....Le.H.].V^S.5.j....A8...c.l.>...Q.N.r].4....a..v.5F.0.......P..K.)../..8...=.0.]]o3?..L.M..N.<Ma..V.E&Z.M....v..d..3.(..h.dqU....k`h....64...%..s.c.[..(.h.PS...f....M.)OE..I^x.n..oZ.....&.F2.|.. Bh..v...'\\...f.....8!..s...N.s.....o.....J.q..s.snx.....q.le..AM.....Nm.d.....t.0.&..JX....A.t+..t..._.......X..4$Y.....9...r...........9.\..Y.Kk...{...i.b...Y..}.I....%..9......[......F........}Z.{...4.`.-k[m..A.....-........H.`*....+......[R{.W.fV.z.!....G...............u..#i.x...$......8w.).7+.......C}{.%.9NG...]sv6*..4..O..Uo ...E.N%..L..b..P......~....~.....F.m..g...|J..).......V.s..'..7..3.)D@...k.....Vy...6g.2.s.CHXO.[M.0..[..m.../t.B...Gy.K.T.....6..2...j,..#....b.cc.Yn6..........>.]H..\....!.9..i.z3..8b........=......W...`[....Z..-..&x...SBB..P9.b."R..-....e.~`~...E..>=.l.^o..f..X....l..7.......ro..K[.|.......7_hH.........um.mP".?..X......~>...w.p...q

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\867f6a95-618e-48d8-8f7d-df65d8206fd5.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7421
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.979596310432721
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:3F962BB407D97D4C45900A756A30D7EE
                                                                                                                                                                                                                                                                                            SHA1:0EAB1E241EB754C5B5DA57492E6CD68205CAF7AD
                                                                                                                                                                                                                                                                                            SHA-256:253600B046DDF24B2151B36E371A2712C1AA2071C6CB0ABF27BF052C0488B0A2
                                                                                                                                                                                                                                                                                            SHA-512:8E9115A3F7A6563B8C63D6125DE1817CAFC1DEC8FEEAE6D6A89733E5BE3496351437ECCC2D490CCAE1F0D0F9946604114ECA684D3F4F72B8F6D4BC8D73E1F897
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xu7PRadEpmAKCzfLF6Ib5vJzvD3vK7eoZ+aIp+ON3wBs=.....s^.7...?..v.....~RC........8..X.u.. E.P..G.S<.e.....+...?-P.5?r]..L.8..:...5a....X<...K....sC:.}~!2..Pon...r.}..E.E.@.D5f.".^..8.].6uS{....b....?HA!2...n{-O..Y.!_.C...b!"..X3.,.D7..U....../......g...O..:...+h.<.#..:_V.=.5|@.....#..'...........2.zo.....X.....^J...-K...J..*.8xb:.|Jm.)..E.}t`......2.Bo...3.....5.g..V...nk]...n6.h..8B...{-.. S.1..|.v....F.ba.{U....rm..N..]...+H..".eU.dg.Ur.Eg..G.k..o|......Yh,...,....%.6%....p....<.t......%4$....[].P....o.K 0&.......h..SF'&...u..4;..-4..nH.d.B....}.b*3 .oO G...M6........X..B'.;X..+LT1.<..;......J.!..+>@.P:....I.<....}.....1V!.u.|/J.=.....[*.P.KU~..:.Rz..tr...~..Hf;-r~.Tp..i...iT.5...o.<G..k......r.fW_.T.....g.@...F.#..V..q9c.p....(...G%......".m.....R...EH%F.3...!w..T.Zn..G..y.-G..b.\e.dm7.Z...O}..[;..d.....[.W8.uL.Y}*n...2o..=Ps5.{_.........w~.(.%S.........:..2...L#.kq.............uo...v0..R.V..s.."..:.].FU@0Er<.<.A.3......W_......#..Q%}..?..H

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8c3c84d7-3975-4b3f-8a2c-f48d2f5ad344.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1949
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.904799965722704
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D5702E208A8B4BF37EDCD70CE388934C
                                                                                                                                                                                                                                                                                            SHA1:DC85B53C49526D60B6BCF14584428858B0B1A845
                                                                                                                                                                                                                                                                                            SHA-256:040DE3F37CA6AADC9E3076F6EBD03714EED8FCC23F96778AE44373778EC21D2A
                                                                                                                                                                                                                                                                                            SHA-512:BF8751F501992C566C7BA6AD803F4F388312A8BB15940C0D3E9DC1FCBCBCC47626B8CB996F2CB5E4ED53ACB8A5AB55A4060ABB478E2C4A27D470FDFC26D144FC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xo5n0J53QJBDd72b18wf1QOn1zox6oSzOlt9RZtmttso=......S........./......d.1/...C..(.OZ......0"........}.DH...2a......N.T...XI\c.#.4.vd.gc....[KN.m#........b..]..N...z?..W]..yN.(.k.B..[~.`7..PL......|.......mf.X`....k~.{v.......M.k.E.=*......g...s..>.....p...C.y......l(.>dG.S'..K%0of.Dd......\.6...<.?e.-..d..x..~..w.\...R.v......4k+L.&*..$T...)...#-....giu.Q._.C.......P.7@..z...!.D.A...P q.E$N.iL..,*.O..>..5F.....'(./).2...........D..v....r<.2\..v...7..`....^.)h...'.c.X.X.....0p+\.0......q.{..'.....Ih.!....D..xX."7..nU.<.+...7........S.......)....R\...]...C..r..._.&..1..DE[..O.....7........K2.#).{......0.g...^.......1.q.Y...G>.....h.....}#..v..J.....{..V`K` {.h...L.K.....b=...-ux.S.bh..#.D..)vU.......Q .D6..+.P.b..S...!.|.Z/.Q]..nD....qLB.A..iW....gfO...K.v.N.|..._..........wQX.<.&..p...j......-d.......w:b...^@..._Ga.-yXA..h..0.{}.....V..+..tK......8....U....)..#X..).Jp./.~.q......q.^.~.......v.*.t.IDat{..D..S.@.`..+.6.dJ.:jv}.5)..-.Au..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\90aeb8c7-44f3-424d-b339-c579ff412858.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1437
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.856869093609145
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C37209ECAEE185493ECC1BDA089CAEE2
                                                                                                                                                                                                                                                                                            SHA1:C8F30EF09B4B4E163F25E5EA9B547BB081B28D49
                                                                                                                                                                                                                                                                                            SHA-256:5AC05E21B65F3F8092391CF6F03691B15EF71A6D7A2F2B6668E4DAC3FE6F0C95
                                                                                                                                                                                                                                                                                            SHA-512:E7F886D7BCC5222E71B63EB6A3E41FFC7FEA19A8BE7FE9976ED5646002F1F63F88BE6ACBCF5D307AD8E75A77A8BDD9BF5BD6B593DA8E8BF259E5213A266299A0
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XFCs2SRTri7bG8u+kIhMFr2la66sGD/GS235OYOn34ks=..........T..YzqO......S|U.Y.E.a...)h...A.zgp.+"v..]nm+..:OFb!..S...N...z.M....:\!..'.....t.....:.Z..}..H...d..g?A:'Ah@G.8-.b+...n+.;[....0....T../.^b:...qVH...Q.$.+=Sr..B...H.6gK)>...b*..7\......SW.b./[..^.....r.(.....0...v...M.H+;..C.t...r[P.qB..9..O.f.e+...@8...3fj...K$......[=-....E.g..#..#..l..W.....}>.BV..X./....e.V....9(.<.G..Z.vpF7_u..b./..........H^..k....&T.L.h].".k....6..."X.....p...!0.WwS@n(lE./B..H#...55...Da...8.....:.....P.'..\...tR.=...B....k....&.....P..p?.....]WO.b`).B.....ZT......Y>......$.$W......e......)...".(...V..,_..22.:SAu8. .....^.[.....'.w.G.H....r..#.....g3....'4. E.:..8.p......X.....7.].J..Z.B).Mgo?.6...5.0@_.N.h.w.Y^.....<.W_......,....o./q.*...;b4..P..&"Y.{%..%...**M+.....Qbw.....b..ZqL1..V+........NJ..%.....6.=......}...G.........e.sG.`.b..U..u..1L.+qM8...$.a79.y.Xe.0 `.K..6....1...^.F`P.C.U.....(.6.<..._._.....} ...q.&.:.P..q...ba..,1.m..._g.y..O

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\98c344b3-a43b-4e12-bd4d-47b1e7eb6a99.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1485
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.861462788915457
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6542DE791E75106CCBD3B590CD9EAFEC
                                                                                                                                                                                                                                                                                            SHA1:FD98C83DCEB71EE79050E257C018EEE4C4ABBF2F
                                                                                                                                                                                                                                                                                            SHA-256:5513A7DED0C30AE72A02CFF9D22040D43317BFE2BA05AB1786BBAEE4E3CF11DC
                                                                                                                                                                                                                                                                                            SHA-512:E5B5476CC7DDE9B891AADDBDD36CD1606F5316BE8F791D8A522FA91F8E542F37C4C8E6FA27084FD02AEE5F70F56A5276895F4AA0F50394367D847876AC3003C5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XzLoOoWHxq2HhednT4bsDn+rP/ToUCYeZpys7FNCNjRs=......#Fv.32F.G-._..g..Xd.q.,..E......."n.i.m1"....co..eM.......4d.,]#._.....A....-6.%.rY&|..W...!x?.<K.h.i....s....5..6.a...]E..R..[.)t.9..........h...lS.......n+...{.b.+.@.K,.....e...5y_...r5!<...4.]...m&PK%.92=.H~.u.f.}./1.k.n"..@}Q.$|i.>X....Cr.Z.Y".........r.0P...Sc.....k..EW...!/.....NV8F%....6..x.tG..@5m"......x....NQt.<..:n.E..#...}Y.t..A-..H..J....pn...Y._!...M.?.6,.&D.?...$.$.r..q..m{K...SC..^!...H_...v..3.>...|c..i.K.]MW.$.1.r#+._qy..:>.OcS@...p.....bG..d.9..Y..tt......v.q.Mg.:a.<:..+5[.C.K,.......|.I."@kQM.p.T.R.P.7/=KrP.T9..c..5..9\......c..T..#.-.....{.=7.`...4nX.#.fj>.~........y.().../.i?}..z.QNE...........aD.v...^.<.B.g.`D.......u...Y".I..uo..U.=L..!...j...)..^.........0^,../.<...t..D...;.\T{.....+.p"WQ. .y..C...^di......0;qM.....*...s"......u8...k...$..4R".."Z..._.o....gw..Wg.K...........+.5..+...........y@..c>.=&2.~Z....:...[...6..n...W>....3...GV$.J....kru./g....}...Wj

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\98d91cbc-6e4f-471e-8ef7-90a6cc879ae1.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1277
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.852985797045013
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7B8242D36A3B937A61CF7B370C3FCEC5
                                                                                                                                                                                                                                                                                            SHA1:855DC73A1A98B339B6FFC01E171CBDDF539F1EDB
                                                                                                                                                                                                                                                                                            SHA-256:7D74886A88358126977CBE6A88C3B271A8B2E1D17E0DA0B36CA3DA1691962385
                                                                                                                                                                                                                                                                                            SHA-512:08D4AD2EEA4DB4876D55B18D782B13CCF9E30AF6A36AB7181824966F7621F4F8BCD68A6390A87E7C3BCC4F876B1E9B73ED0034CB060723BED83EB57BA33A4870
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XrL6rpAj7lKV4auGVw/ObM0w2DBQGijl+yVo+sGPXfpI=......9AT.e.5..k.?.-.X .E...F.L.L.....m...8.\....T...T.P.@..*[..5.....w.b,.yh.k.v.6.b..[.Ps..."..b?.=z.....|....N)h)...)8.c.<lI)}....!$~.UZ.C......y.6..h,.....t.jM3......^.....a...<.t'Ca..W... .HSQ.4..8..E..=]..@%......7.d7|.a.."X.........Y*(.25>...|....E................+....O.G*.+t.?..:fL.G.f}[..Cx.~.|V.?.....!./.K..|...t.y.`.Sk....fd.....M..|:.bG.PH.....Tk.......W.....w.R...k..!.Ez....h.s5q....m[.0..Xm.f~..F.....:.{.K..|.zZR.... ..G.P.....l....g...a.:...B....Q.....H.n.E..Xp.._..../..O.......-^..G......1j..6............u.f..].6..y..k?..9..@.Z..E....ge.2...Q....@Ylp..5?!.B...`.8..!..yC.....S....x.3[.e....r;.e1...?zK.>.V..@.*.k..N2eY(.|.."{O...X....p.4i. .5%;..h.`..C..R(......k.O....n..n...D..8S......b.......>.....x.*......C.FO..b.B"..%tM^..=2.X....;TsG...y........].2......n8y.x.Y.\b....M...z....9lBJ........]....Ol...a...J...B........bG.J.=.z....l.-J...I.N.DVa..!.8T...a.O

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\9ae69223-0ca0-4b98-ae14-4d8b8ee056af.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.977620879459599
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CA8C80C45B01D1E0AB106B7C7562A659
                                                                                                                                                                                                                                                                                            SHA1:65043E694EC56289A245095C4FC596BDF36C5891
                                                                                                                                                                                                                                                                                            SHA-256:193A41C33C6EB6CBE035E8D4CE985571E9FD6B2DCADD083B5DB7748661E8D01F
                                                                                                                                                                                                                                                                                            SHA-512:28440E6C654F9FA1C0793B19294A58248EF91A2B57CC9A1F3B9EB1CA9D870B842400FA7453F7EAA37055CFC6C27FF47DEDDFAAE47B5F618C67A654E4ED732FE6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XOFzHfSRsd892byKWSGYocAMfZLZ9bqx075ykYqipsGI=.......=.]{#.NA..Z?.8."I..i.,0.t..o.Y...@k?.At.i8.k.~s.r...t....O....Oo.g._k{..hd.'.,\...S;j...s..W..i.".W.."(. ..h...D....\J....n.....z).&.....2..[g.....d.=6g....f..\W..<..J..F.^.i.....{..J6_.~o.g......R..7......T(....+...8A.........h.A.R.`.8oJ...FT:..1.N..`.S}PE.%.........=lG.xh..g.'.....~.r.....?.&.f..;...^..6.9u3.Ut...#Rc....`q...D..`.4.}..>..9+i.r.%....w.l.d../.9..T....d5.9...w.Or...r)..p.......;.....X.#.:...H.S.j.`..B6.K1.W.3,......^Y.,.....=....TKS....6fC.zW....F.p...Ia...x...v}.....e..a..C1.O.....Ah.../.Bh..".c..&a..f...pL.W4...s.X....Y...1......{.Fc."A.ds'..c$3x.B1....~p.....`....tQ.mz.....z.t..[~0..e..T.,.....|$rI..W3...&...V.........FP[2Q..xdf.=..:`F^.,96I..o.~.,.S........}Q.L.....e.0....;J.Zc.\...KL.f.........<.U4Z..Q5.q....fYI.+(......-.6..KL..N.w.....af6..@O^....h..l.....}.....=Z.G@[Q.....1....)..\.b4.-.>^..I.~(5...pd..Q...^1....h..i.W..%o..4z..=Z...-S....lK..fe........Z....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a092f339-2c96-4205-b6c7-fecacf6536ae.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7021
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.973928452888025
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EAF9102785E4C923EDDB305716B4D41F
                                                                                                                                                                                                                                                                                            SHA1:7EE3B756AD0EFAC0CB228D2AC458C93E60D44F28
                                                                                                                                                                                                                                                                                            SHA-256:90824867DD9136C777A282D2E6436BF28901CC4DFC1CB60E062300E2A3B70F46
                                                                                                                                                                                                                                                                                            SHA-512:8A332F0BE5290D88159FBF6E75AD3F22E3883C433EDF2F621630990F47E18527898CB82B14DE7D5306BD20204F98EB4209958761A128A84F653AE8B685D6955E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XIz/ZHD4Qq/sxrZMOEN8ogId11Do+H8I0nWUKfKozXC8=.....lm.....sf.PQb..W).gh.%._z.....og.xp.....z`8x|.W=t..`.T..ct...{...9N....a..i+.....8Y.<).A.....$..:.w.[{.2.[.&.....^....U...gw.d:Q...U.qP.w..I.....s2..9.=.l.:P.f..Y......b.*&W8....b..|.@..d.....7.'z.Z.......77RB....Ox7...O...P......}wMtL.e...`...}R..o:...=.W6+yM.....j......;[*i-.S..%f*Q...C.g.$...s.<I...o..HA^.(...?<./.....\.3...1.+.H.&[....z..........l....C.&X7..}$I...A...uR....q...F......{....Q:9.'^..b....6!...\.....!.XGK.a"..R...y4...S.....2Y%.`.l..N`<.R:=...]..$.~B^....'.....N.(`p.y..+/.MPD......"i.9i..... ..9.b..FE.-....nHs..9.$.6.+m.|,D...N`..q.Y.d..t..B....9...T7.,B....1..%.u......v.1..~..|..6..A.\7..0.O%....%.0.....y........5.n.!iY.t...)7...~]6..GM.h..%}>.S.{.........tsY.\}.%.an~..C.c..dIJ....(.Vd;[./.G.P..%!.....@....(8..,.q.X"p.r......;.......1.a.5..\.y..G...f6.M.$....]...l.]hc...|d.M..$&...C...N.....Gy...9..\..HT..`...?..'.D....s.0.....w.....d.....X.+.............2m.-M%689,v..W

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a0cbca0d-6ddc-4fd0-b420-8bbda66e25f4.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.980821502455815
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:DFDBD330E277C60A380F5DA5CF1BAD8E
                                                                                                                                                                                                                                                                                            SHA1:DC7161C0D35262182C73BAE3B0F24099A205ECC2
                                                                                                                                                                                                                                                                                            SHA-256:3351D480E9834F5A091E21B852205D974647C76210081F6E174222C3A6EA823C
                                                                                                                                                                                                                                                                                            SHA-512:DBAC37AD63AEA017065A42F33D43B4B179ADC474EA8E1952FF2FAE74BC638F326A6551DF9DADDC7149D92A950C378A421935516B86DD63F0AEDB382E665CCEC8
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X7XXCHEzOXVJ90Reai3eaPv6+z0zequQ/r7RiKSXMl+U=........3\.a.,..'...}K1Kfh*....t....o.....x[...~..bZ..^.N.s.0..YM....2R..#{M.....$..|...D...zB$'v.|.Cx....u.d....1.KE.D7k.f.Vh.%..?}.S3..E>....^.........:.<?..P..S....(.*Z.3.}o.o....x...m..k6(.!..o...%.C..33\......=]0.%p.S....q%.G..B.p..#'.?.;..<....o........ZSq.......0t....d.....@o$.......=~.X.O..Ud..g"....^X....O:]}.Z"."...z....J.z...wDE.V.....b.x=..Q.Q..6.......a.*...v.f...l.7....^.<..$..;.r.J...<.q~N.....D8.A......)..2...^..w..+K....\..XZz..R....%o...Teb...uJ .vO..8..S..]......#...P.:.}..Q...E.....W..5.0.....'G...HO8R?..el.J..DB*..Od.* nb.......80......Ir..6P".{.q.w[...|.um%t..*....Db6K../|.=...c7.M.$C....9....N\.R...F...GZ.au..?....^.......m....M.Co..{C...I..F...`.o....a..l.\....i....E.......}.^k...W_.....5.b.{.l.u..9..@........R.....>PK^A.d....zwy....b.KtK;"D<..`d...&HE...x[....B.h..<..xJ..B:.E(.y..jRq@@....+....k+.L...@..%ws/.$Z..X@..wv.........N~.K..!P_..q......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a874d007-506c-485a-97b9-368437b0ef60.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1933
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.896847195569596
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:216CF39BCD3BFAA5B76DAFA8357C80D4
                                                                                                                                                                                                                                                                                            SHA1:82D5200344CDE4B7CF6204AB9684986105F6ADA9
                                                                                                                                                                                                                                                                                            SHA-256:EA7860E5EC0E248AC992A89F8B007E06C3F175C9DE0E68870D15DDBC1E15B9D9
                                                                                                                                                                                                                                                                                            SHA-512:1E15A8092EFC2B29BE41831184FB33ED3F5DCFB4B2EB26459062B6483D628D37C92A1930DAC5DCDECBCA92A11DB8C13F0AE98B514756BF49530D815AE5626B9D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XDD3Ma4Zlp5sobAadoRSx4kOAjmEimnJRgHsNAxMprAs=.......Ny....#Z7xv.(.8R...PLBk..mD8..~.>.._.-$....._=U..b1"i.D..j.V.e.w^t.!.^.k.WR.K. ...........?o..0..>.9R+.Y.:.K..8`........#}.....<..+iEy....m,F.x....V@.j.uvNP~...W....cZ-'"....v(#S......Q..f#....1.ZS....$YD.v|.."..n{A.......fd..iF}PM).sg.m.......j....?A.T..Bku....H..FV..Z.$>=7^...Z.R)l.....[|...iG;Ew]........Z(.]...,..;......,...$.o2cA...b.Y-...C2.D.>V4..%....o.S8%..q..B4A9.....F.}?...e.R...q...{.y..x..r..{2/.O..<.1.e..........8.A....X=.).....8obQ.....Z.(.t..w......|W.U..X.........+....T...E.!~[.....J./(.|z;.....{?.$c..K.......I.M...d_...N..^.c.pA.A.D.*^.l.D.d.V..M..TX/!4).....y....=...u..9..M>.=c.t.A..u....^...>.^......yF..MV.P7iY...-I+.=SD..W45P......>%..$.h.O.....8.a...`..`.o.#.l}_N....M.k`..X.....37.O..0..........zA.:n!.......B.:A..i.s;.w...iF..Z.n...qV..NG...c.)4.B.."..........._U.s.]o N............j..v..O......).C..........Y.|.,...PM._.`.[.7.@.V.M%...h.X...._#.P.`.U.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a8874ed1-e97f-4eda-a3ae-481b1e361d99.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):477
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.485575235397858
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:52F752186EC4DEE7162B0C6DB8BAF000
                                                                                                                                                                                                                                                                                            SHA1:B2EDE3B54A5F1FC56EFA1DC4395E3CBF6773088D
                                                                                                                                                                                                                                                                                            SHA-256:CA03742B96BB18E4CC22594B3E04DA7A5859F95D3BDB05EC78E99017570DE1E4
                                                                                                                                                                                                                                                                                            SHA-512:D2F72B8CD29B85D042524AA0DDC4DADA70C7D14839590D1EB5732CDB15A15172138117487E913592B2E40D6524B1751642B24C0C20C33B78B8B80E34630C1116
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XAgs/P0f+zY/b63KPqPAcrb5v+tEvABIie0L51sY0eTk=............5.../j..|I....._....).L..F|.%...Q....n.^...14".d...z].....R~4...yr...:..L_7..w..A......|]-X.t...Pe{..*.B`.....+.R3...1J...D.(.^.c... .6._?JIl[.?.Xe...~...ke.... 1../...-.M..6.].;..H...Rn..kT.b.:..p..n...qf50?0..Ft.!...ryS.g.ls^T.{...........tMC6.M..s/....>o....i%.....$.BMm.....k.....}......id.....\.#x..."._.j.l.-..z.:e.i.L...I..;....u..l._..A.....m..t..X....d5.T..g......~.BHR.........

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ab089dba-ec25-453c-acf3-a015b8efca0f.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.980396649280725
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D4CA28C66889C71A1B683365BDB3D2D9
                                                                                                                                                                                                                                                                                            SHA1:E76CD1F0908BA8F97DDCC27DEF23EF024277236C
                                                                                                                                                                                                                                                                                            SHA-256:5D914EBE58F9FC4AD13D3DE9014270CE3DD55E81A0552761FDC3440984FFECAE
                                                                                                                                                                                                                                                                                            SHA-512:D73AF16BF353AB5EE73D27E6D6844FF0FDF8ACDD832F340AF78AB1A4EA964888608C86718F170606643EA47CEBC090837EB473EBA8B83E564B7E7C43E42D4F45
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XFaOvZu5jvRU5IOVUg5r5tmYD1TWcT6GzcBdBV2VT1I4=.........&0W..!]., ..ZY.8......)9.#.!^.!.P....%.G...b.7)..b.mvS..A3.....+g.`...G.5.3H.....sU..i.]......>..C...o.RcuB..M_.T.`Ho....a...na..`.J.J.1.O........8..-_..'7.....Bf..<dp..R.u...C..J..z.V....M`...Z..A*Z(..zG.g.f..S.LU.,..?....Jq.rZ..,M[.......X....mnt..B.2%.._.Z..w4.#...6.n..s....Z".Y..b.kF.?.`/.O..@..4..|....{..../.K$...\U[.nl.o..-.....?..\......i. E<.=`....M>..Z...<...'\..C...X.w..V.....+J..!b.L.f.U.|#B(.P.O.H..}u.2.uz...?..(.W.M...;:.WP.....4.*>......yV..%..g.....$E.....0H...........R..<.[s...Q...p3.+..b.cG..../E.!....=..Wtx.*.k.=fu4T+.5X.G.Q...V.fd.B4[.....cQ.K..Q..}h$n.5..-x...y.....q....h.......RB$}.}N.6.<.m..6.%.N?...Q.Dc.R..,../.B-.T......g...7v.../X..E".)8,..9..k.1.....r="..S...~.~..q............. ...a8...C...Y.}.X..$...7ZC..C.icT...?T...$.....).$./.q....O...<....H...`np$q...P.xa...@z..r.'.N.-..2....n.)....us.......b......pN.f........f..[..L.0.H.Z..`.....r.&(?@.R8f)

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ac30f0d8-a6b7-4216-aab0-1de0f9d89b20.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.972358406547343
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:B47A2C3D5DA09E0D482292613D5C1E63
                                                                                                                                                                                                                                                                                            SHA1:ADC6B5385F5DA6C64A627CB64B846986E679071E
                                                                                                                                                                                                                                                                                            SHA-256:EE67D5FE07CD8F2547E3F1E736FDE027A240D4DB40479AC74124A578ED17D008
                                                                                                                                                                                                                                                                                            SHA-512:05F284A7E9C61F4978BD5CBAAD6B1200DCCCEE1D81C4E5ABA18BD8B56BE56F18194C0D5BCA9BA7925D6166544C5562163529AF6C4333FD8E0D8D2BD5C2BB514E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XibRADhIVKWCoybEOufYYHTOp43VUA2sEBc+qK1vQwvM=........f.c....+...........3.}..y...f....F....hI.v..tUVwV..e....N.w.....T.b..Qi9<L...@......o{M..t....+.{..Rv!.t....V.$V*....C.o......m.../(....;...........&..k..o.....6I.2("F..k^..+.C7.R.q.v-D.g..N.{W.%.{...Y.}..+.\*.A...b..%..|ko....=.........c\`y.&.0dj../..m....)y....Zw......G...q6].u.@..2-..8[.......=...+.4..Mm...5r'.......1.......W........ ........^i...E9..XB.7../T...wW?2.R@O..8v..%r.g..>.~..m.p...Y.Z'..7T...b7|JQW....w.a.f./|f=k.,..5..k.=.r..m..Yh..rc..q>.gH.g....L.4\.SI..t..t..R..Jx...(....M..s...f.9@.`1....".1......_]..#.....\Z..dG...r.R_5*.=........r9m.c...\(l..DI..d.e$..`.@....GN.@........Z..$M.zYe...z2...#... ~X....+VM#._..`.2..;.....nT.^..`........<@...s.Q.g..W4p..nbs+..;....G.......5..9.s5..Z..O.jc.[!.`B...'*W.g7.(M...`..G..VA...A...15...Y.l..O.>W.j.Y..=#rn...KV.3~&.3...$..,`.8.$..)..g.......0{......6...F....a.CpMR.[y...@..b...g..K`./...2..S.......<:....v.......W.6T..M.v|........k..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ac8d39ce-3e52-4efc-8535-2011df701fea.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.979106106078275
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C2542EC0859850BA5FE5D00F1F803FC0
                                                                                                                                                                                                                                                                                            SHA1:50906B0807FE06C3F6E54B87FE01509B79F906A1
                                                                                                                                                                                                                                                                                            SHA-256:FB63AFDDC6DA88259BFC3C07F83331AD2F05739135CD0D338AB0AA7976A763ED
                                                                                                                                                                                                                                                                                            SHA-512:11697042D1891D3D0AB5056D733A5AB63173094EF392AC7F202EE0E48E5D6491D9B3C89AAB1FBC8990E59FB7D01C26E29052FCC4B0D0217AA47FF2A0891741D8
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XJWcherOuTQ2LhUF0LBrM/RXy4Z1BUjGOL+b0RSp71Ts=.......!.s.#.K|..(Q..1..\.?.Z.z;.Sr...(..%...L..~..e...W..I...3...[.'(~..yw.^..%h2 ..3....A.`..;.0.=..... . ..,Zn......a...y..s.p...h..Nde..4.......i.V}.L.8.......&....c.vF4\.>a..EP9i.q$.S.W.'....^<.....<K......".o.+..,X;[..6...J.<......8...y.V...]`..L.:!.vS..;..j.B.{...p....Y..._+......YO...!t.. .3...z'..%{...^.}.."SN..K..v......0.....Y.D...J.3..:.`RYe-...R...m.4...;_..<k..yI'..q4=..d...*.../+......]......;.v.....a.I.^.uu...PC.M...,....=Pt.c..N%..$d.M...q.d!..T....#..I.........+....$.e.O.tM.()..@%3H..|.(...J..?.aA.!.....<w.....v$>.C..I..NU.f...g...m.=...,]Z.'5............q..d.FZ.X...]..i....I.b!7../.s2Q|.R..J. s.M[....n>r,W..B........W..L.Su.W....|'........a...D(......N@a...7...P^...+r._.0:k......q5y].V....;..y]...........,1..8v..8=....rS.<-.`9....."^.tl.....d}.JT.......O..8.C.^;....r.d...'b.3t.bz..D.v{Q}..}[..,....l..5.o8.:....]...-..o..[....R.BJ.....;..R..}..jf[.....IL.4N.s..BzG.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\af369080-01dd-47ab-b5f0-7361bb108f87.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.976823124771982
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6D4476EDA16E6F3E95DB447650871AC1
                                                                                                                                                                                                                                                                                            SHA1:844CC01DAB4EB246E5308B5646426BB87D66FB17
                                                                                                                                                                                                                                                                                            SHA-256:A7A5802E77D5BE8AE3F2A12F84F4135F4E9DC799B5A140FBF2FBB327B656AF4C
                                                                                                                                                                                                                                                                                            SHA-512:99E07536A5349F1FB8F688FBE01848D9EA87010AF3790B2088FFB245550605C1F93F9F1E455A5D118316C2D2A655E68B405BD6F09AE08C2A1309BEE164052780
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XZirfnldOuWCID7rV1fYQ+mHX22AfQVwLN1xaRfArlMs=.......'....R..*.A.2P.6..i.......M_.%...d.\ul........&0..l......sN*..m`#P.p.W.......hD....{.A...9.Ir~.J......a..y.R.>.s.f...WF.....3f..V{....`!.Ym....3z.....Z....<...^$.z2.C..A.?....F.*...iFt?"k..Y...C3...7...FyI..EG4. m....e.7e......:...g!....}..ML.Bw...w..:.b1..+H[.....`Z... +...[...##.Rk...W,..1D..d.....v>....Y.y....3C...T!*.|...u.y.+......"...v..;j.N!..Y...........FJ.y.r.0..UTh/.,.].'I."5Q....$.....f(..3.F...B...Z.F..*Q]v.;..H~...lz...#UAL+.h..~...........7.5..X..{_......;................"VL..D.MV.y.|...h<.X #s..i..i.x...l...e.Do aA@....%.....Q.7...}.m.x....9.......[.&}..I......=.......p7....J.......3.'b./N<.m.pp.uv.y ^........nc..s..p....X...N...h....;/U.@..N[..."...P"...h..D....y.=...U..D-.G.O..0.K6..qk..8..F....;=.~.E.$.!..:..+.@....5|....]..z@...y....5Z...0....B.... .|..}6.;.*:J?N...........|X.<..q...6.-|Y.....W%}{-.h.w.)..+.....k.......,.0.mS4...H.....3../..F..P....FU...O

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\af6d0ac7-6b65-452c-8464-6ab9af109bf1.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.975801658041988
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:88A743AB22E931BE6702CE9719D7BFE6
                                                                                                                                                                                                                                                                                            SHA1:56D077B59067B230C47FE27FF38D6508E660D9E4
                                                                                                                                                                                                                                                                                            SHA-256:9AD301652B2692AF69FBDB1BAD26043150FCB1055E1EF062FF8A69EF97C1F959
                                                                                                                                                                                                                                                                                            SHA-512:A1FFD3638797DBB7E798C15C061F4B6FA2BF3D9DDA72A69848BDEBBB3AA3C5755A90C405ED0C3F7528FE065216B6AF05D3CAF19211B75D65C5D8F5323012D112
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XlfRYAoeNbDp1IosdgA2vxUyBv0k1sQSGIeUBjPQOFbM=........x..5/.9oap.L..../......6.9..)...wsvW.u}..9..3..]t.d...4...=-....BY..LC....n*..p9q.9.[..o-.q.|....|T.....y.6./J/....F...*..%w_..."..M.\....b.w$.|....G].{&%.om..g....k..x.._V;ZMr..f;.PL...X?.._..M&.41V.../..\hk....\N.....,........%.....A....G.|...JTr:...'....A...WN..W.$h.$....F.R..wA........f.Gx....?.p..0...@....r7.]...<>..0...h.P=).m@.x.w.. $..e.Er...<.bm.y[W...ZH...I.G....v..[.~..ux.@}i..-..7)......l;.UU.[i........"D.."..{....'<.D}.... .^..........#X{.9.{S.j..*[1(".Z.0.i7.T..-..Gv..O@...b...`.\R..w........}./-w5._.]Hq..?dG......*.P.i.K.....|R..o1..D4....qb_.v ;.)..,....w.cq6..31J..w...O.1..t..V.r`...d...C.P...3a...[kp..?..........#mC.,>...Tf2....Y....s.V...1.{...{.........i.....Qx.7......E.P.]w...:..4q./.9...i.....ne......3...E.M..g].. ,!.r...U%..BB.n..'{..uk.4%:.9.t%)..r7sBl.M....#........z...h.C#.5...$...~....I.4.{Ba1...U.x ..X...-...R..Q.4w. f...Qyf.Z.b...E...lMp..|...Ei_..[8.qq....%....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b1946162-4ca5-4b5d-94ac-21bf2eb6a695.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7917
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.97699464996161
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7E5467B58D7A16D31556128574BFBEAD
                                                                                                                                                                                                                                                                                            SHA1:4429C44B9D6386B518D64C82A4B5070570E177B4
                                                                                                                                                                                                                                                                                            SHA-256:3CB1BC7489AA45BC4E445FC3654E785C515E463DEF5C5A8E336A25AE593FFD29
                                                                                                                                                                                                                                                                                            SHA-512:F83506A7EAFD985207ED5AB47A5E1CD4201175AF490235F664B44E3B9E97871FCD8F891CF57A16E02DD6FBF937C6F78936D33744613698E4BDB4C2877A19964F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XveaZ5mtk2SkJz5rs03a0M5jpmNhPlIYXcVpZVip29h4=.....z..F.4....!.#^...<.T.kQ..._...2.+.N.'.5l%B0...R.u.!.HU..cl.+....O.....zw..-SJ...F...@..X.Gx.j.R...W....0k.`i\..i....+..-.f......fq...ua\.vU..k.8...^.R..F^...jq..g6..|.s..g...7..pF.~+%.......^Nu#t.N../..m..!L. C..# ...h...d...7.....z=.*C .:!..j.9..sy....2......./.m..~..j..z.8.$.gA.t.R .dD...Y..,'.....i...D...(d2._...s......._&.....%...6V*...AW...."!..p..%w:$.....I.R,=L.#.][.!'6.F.a.....K.....`........0...).....1m...4.|8......7Q.i.RJ..p.;...r@H...`.8..`)e.9n.o.o.}.%v6.Q..A.....v....2...;.....A.F..u.)9...!...K...."....{,.TMg...uV....%5@E-...v.7..a...~..#..yD%...|.l....Xy..>$.....A..R.h.Q...``.?..QCWJ...k.J.y..*.Ug....~...d`...ig?.x?.B.....;8r.)b.nv...(..3..$.....B.H........X...z..e1......8.;f...'.1....Yh.G.......+I.U..A@......;..<..y.......i...-T.;A...".....Z.....3q...%o...=+Q.z..........[...T.g.m\D...l..Xc.._.G...>..c.......j7.j.....j......&J..G.2.:.#...'4.%."<&./tp...#...Y.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b25734ec-f80a-4fd0-bad7-0481cfd81859.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8366
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.9788334790711115
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:236DC78888B733CF24F39D48B730ACBE
                                                                                                                                                                                                                                                                                            SHA1:51A349F0485B97252B4B4546229FB97FC6F05CF4
                                                                                                                                                                                                                                                                                            SHA-256:9A3ADE4953AE28B14E840A2BAC03BCE2D3748979FAC0C0C1FE079549D2071B6A
                                                                                                                                                                                                                                                                                            SHA-512:4EDACE5353657EEA2AD18987CE821BD1D1FA1B56D4ECAA3C376C80F28452772CFC3DD1F9A15C8D8DBA10AEA16E9D0F6FEA226EAC34516BC1E9F5F8E11F1CA08E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xk9xnYBEgfh5B+/CQkPHKiFO4vrpqODcecdn7DHFxxTA=...............[;...../....X..d.'v.m.....{.\..-...?.jC...$...L.9..K....j...+....Q-:ny.qi...>..@".y....*G..5..>.....yy...r.....T6f.k.~,...;.+...m..Gx..0..3.....x..-...eR.....\E....6..|g.N...@'...G.k..+oL@}....:l..`E..5h.5+...J..3.. .3G.w..(..Rx..9....?....{q..,k#F?....t5f...w|...YW]q.B..b.^....b.~,M7.g.C.\....RxPW.#.....c.\$-.G....o....3.T...2.8..Y...J.Y..+a.N...~+.4>S.b.`1D......T.sK......2.7..Rt....1..)...*._......[.-mC..TO....xUB@4..DdE..{.O;..I.S..:.........N.+F.a.z|..X=.0Y../..a.....ky..O\Q&...N)c.-G...m..i......l..;E...nl....e.T..j..~..X..f%.V..fq.I+...>.X...0...k...5Y=K.J..U..\q...Y....x...8:..yl._.....G...Q.I.m....q...v...V*..U3.pz..r..}G...Pm.f.Q.M|5j.N..7.;I..m............O.Mj..g.w.;7S.Zg...g.....s{.....2.8....j......l|......#".....g.d....)@6......o.P..b..2.y.2.....'..e.R.(..I..L..r....;...V...v*.0.d...1..vZD..m3...6.gK.~f.t).....(DXy.p.....*}..............ox....}}(..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b9b90ae4-249f-4afa-99df-6ec5264b5cfd.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):957
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.769410910249013
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:97CAFB9B2DC87D843FE79F095A02B91F
                                                                                                                                                                                                                                                                                            SHA1:25851212274CE088D65412AE9982D3BB214E68C7
                                                                                                                                                                                                                                                                                            SHA-256:D18ECF8B99FEA1ED522D688B3354073BBD6BF64CAC1BA3CD16F7E6CDB2FC00A8
                                                                                                                                                                                                                                                                                            SHA-512:7F6F13327CC54F14822689588ADD99C154BA84B95F7F00A4E4939CF073B0B0B92CFF697ED3B67312E5ADCEEC8234BB72BE16F895CE64F9588C0800329D891561
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XvIkJI9z3h/gM6REEPkj1pzHOcWeAaYtcGEPCRtsOZ1c=..................B..Y@..R.:SY..e....y....U<<..s\9q..99.A....(..........zTV'..F@.8..G#..$..jQE..X.J.....9..@....(.....V:&R.f&j..\\.!7Jnhd......,..&+$e...n...h.y9......~.l..i...1.....>y.v....BQ.....j.T..Q....T<s.H>..A...)....6..a..z..9.s..#.14bi.X.p..F.l..C.P.i.8..r...'.N5..]X....S\.R,..l..6;?.y(-.B...9.....t,....7-....O.Wptq.u..."@.sw.\/.|.%nP.Kc...V...N.J.;y...l}.~.y.u.$8y~....o.$1...."q.5....w...~...;.e...#....pG.+q.-...+.,...k.H|....E. .C..K.lS...T.j.."/.^^..o.....m.ts$.?......>M...4.`.Z9....M.fh.i../...d..^'..1.=..s....3...>....j..;..Op-..z...`+.RYqN...UU.|....lE...3..5-..~........B.>(:..I.(n.t....:.7Z..T.......[.s]/..e9....G..).;0......... ....@I..23.B^.\.x.3.9ihEa\B-...t..V.L....<.........*.........h#...e..(.qt.bR..j..vp...+p..L....m.2.lC...&.{.O2.w.$.n.V.....E@... 3]..I.......u..?.H...cT ..!..S.1X.2... P..].1...9...h.:!.MX...d.L...=B..9..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\bcb8017a-56cd-4c0b-83b3-f172f537ef69.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1949
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.905689840747229
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:887F8987461F4210C8073C8CBB950108
                                                                                                                                                                                                                                                                                            SHA1:C561C0DDC3783F6CF6AF0D1CF5A5B79521EB1BF1
                                                                                                                                                                                                                                                                                            SHA-256:DF5223D08E92D7FEB71F97DC6AEF6CE67CA378D4C0F91C27D8AA15127AFAF885
                                                                                                                                                                                                                                                                                            SHA-512:FEAAF9035D37E356511A09BBF31D32899D1F6C864873FA13D398F83B58AC536C38F1783A9273C74CB48C20F51386EF700CA25382614B0C15FF7144CE35A9D3A4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X7SL/Io+ht7Hok3IuP02Vu6IP3zqSGUL8iGZQwV+T23I=......z...I..0V.J..I....2.....?.v2;.g..h...............z...f<]".X...R.5.-.i"CP..}..A1.r....7..{<.....>4.75..h..<.&..9.U.^.....pz.....0..s...n.wd...G.Hf.Xil.....[i.._g4L?.J.....o..\{...HN.@.,.... .....Kv.mqCD....F....J.P..|_.......#....O....Z:.3.B.z.-39.~`...C..d.Z...!.9dK.........J...1.L..QE.c#.......D.o.+...5hnI.C3:..1b.u.>z.;@{t...*j.(.z.PC...t.g..DbP@.....@..U.[..,v...u..._.......?E3K....}.....bB(4...@.F2o.3./.v......#..+7^..l..",L..'.W...E_.5).zg..3:.})... .s.zb+..{..6y...............6...1.wH......2..q.I....Q.e.i.....?..s...*...Re.W?E.....v+..`..],x>I.%..-t/P.C.2..2a....~..BW}.K|..{u..c..fkJ.?..0x.... z.........(HY/J.l.1r.7...a..ak..x...z..aP.=.....c...........3V.!.[1....'..P.BKF.....@*..,....N .h.7..G..........j...Kz.@02.4o..X..C..z....)^..P...9.75[...yc.R....../.tH......ns=.....C......9...%2b.V|.Do.r?Eq.{?.L!...~.....N.L........WL...-u.mB. ..._....H.~....Y..a./..{.....#...;.4F..e.....OE....,..U..v.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\be0a9f9e-2bb5-4b3f-88e3-35ba1d2bac82.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6701
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.974885772880038
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8BD57DC2FB0BEC742A51755DA7C9C9E5
                                                                                                                                                                                                                                                                                            SHA1:DBDA963C2BC4AE8EF60566F14F3EE7FC0267A882
                                                                                                                                                                                                                                                                                            SHA-256:D1B103517AF87CE390A171BFFD69FBEC2537292C270DFBEAE2D926697F3465C9
                                                                                                                                                                                                                                                                                            SHA-512:8F343804B2C1A1007922D20D81C541DD598AA7BB7C1B44EEF0CAEC61920C8A4DCB8AE97AFF50E3791A6BA1573618D1C7AA8B842D04EC0BB5447F39273F53CF16
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xld8xVsnNirNgj3qprl6JRAQBzUoNNfdQVbdaw0tsZVk=.....g..<8...B!Qf~...}.F3..g.O").s.V.4.....2f.N^k.l\.....\"....Kc.D.i.u&......9.~......)..`.'~..\_..{...+.4>..?8.oW.....6g.?L..........^.a.....2.......p.D...7..b.ZIi..b.E....._..K.T.-..>...TQ...1.,q.Gw.t*........,......4~.t.|..m.#.....Q..nmll.Qa.:ZL....p^;.pI..S..@.=...4.b.......i.|.6..,....S..3.,....x&L.`..~.ODR........3l..'....l..<t.Na....Q...n).[Yr".v...lO.U..d.{....~.~.V.B.D.=...U.<.t..p...'-#..j....)..F].5..BD..d..ZW..d..T.)9]@g?T.f(X..2nr...D.......mR.Fv...L..........-.(.R).t.ni..W.....I.d......o.......).. .).g..mQ....]~......KD.d...e.l.......S.F.(....cD..........*R.b.r.a..DKn..F.*.t/Wx.a.n..MA1...-o.h..D.L.q..'..7....#r.b.E..2c..q....v....;...x...?^....h.BN9.Z...aw..&..&....1S.....I.NC.0P.3.a;G..e..}.v.B...?.%V...A... CnaR**,?..op......i..:..d0n......~Oh..Qun..YPl.k...fB..K....T.....9.3..T..H&u.......J.m....5 ..&..@..M.....{.....;i.I.X..h.Z.....Y..9.B..!!..a.3mSC<x.......s....,.{:1../..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\beaab8ba-0d4f-4a27-81f9-846edda8ccb8.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):637
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.641458955393797
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:957C69CF8E1E5E2DC94D61DE93CF9CC8
                                                                                                                                                                                                                                                                                            SHA1:ECB5217BC57741EF8342600C04BB252DDFEE60A1
                                                                                                                                                                                                                                                                                            SHA-256:687F6D9D519C2D327769547B2110C7B72F245329B62822470C55B87F28843523
                                                                                                                                                                                                                                                                                            SHA-512:5C097F2D48DB917F48BB6910AF64364CB1CFE9FBE0C78FCB7F4734B5E123D8ADFE99F14F185AB850C5E984FFDEFE02A1616C01D7029BA1C4D7990D9B3C9A2E3D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XRsAUPE6oU8cprMetbwdtAKdH9Ayvo/G1jifuHPA/lqM=........!.n....$.1.).......3...s5O....j4R.......k;.jN..tX.Q....8.zh...8d/.6..Y...E....{s.v.q.Q.x..6@_...m.`b...8.}..Kg..et.$K.S.........._..?..F../....]...?i......./.g..A.-.VA.;...!.5......."y...4.......G.t.^...g.~.yu.....U|N.P.%......u`WA..E.%.[.(......L.....:.@.........j.^../.q.&.a].5S .%.eab.....%....F&.++.dor....B...v...Ud."...B]q......} ..........n5.T.....tO.3_..Q./.]......4..$......B........o`..z..$..4@W..B.`...H.?."..&}..F.j.H..Ra.*....Qb.2.....vS.....o...".m.l...3.K.....O..;...{^Ps)U.a7b.....y.P...bH.;o&..#_..p...0B,j....B.1#..C.Z.>y.d..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c113091a-701f-4976-8ab1-77cee26b72df.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.9794567761089095
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:3BFA5994397AA30A18B487BB6A0DF986
                                                                                                                                                                                                                                                                                            SHA1:F9BD3BBFAA3B9CB0089922A40D7A7A0EF3BD87F8
                                                                                                                                                                                                                                                                                            SHA-256:7040E4FF468B41B7B779103BD0FBAFA3E59C7DEB45E728ECBEE945614B7D37F9
                                                                                                                                                                                                                                                                                            SHA-512:CBD2E799DB1F605CCF5D126879DA965C438220528B417910C0A42643478D93E1B63DDF09B12B1B2CC3AF52E6E6F31BE53C22BC9F64AFC4003A307B3C51DEEA70
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XtjwDecST9bz0+4oKOrcYcvFJbs1gTbNe/Hc+Xl1aCbE=.......N.....X.....o:o../J....x..).7T.3.....(..]......c.Q.oj..j).nAE....Wx.}.U(B'.......,.uf.O.{r..0.... .9.!t(u.2U.RU.7%..$.9,(....3C..!L..7..e...S....%..7<]=.;.=.fM.S.NG].6.....HX~.K..x....(o.H..s......<....@.<=;m.._.!!)|"B....~...#...g..!....."T.)5..............C.^.......x.hq....{..._m.2g.<o.9.?.L.&a.e.x....|......;...-f..Z.Vi.|.S..`..w..T#a..C.c......V#.L. a....3..)!..._.w..y....u.y......J[q......i.O.R.....~..v!4.i.,...)......0.......&....\.sG.l.&...L...GD..`..v.6c.-zc...03R....P0w..N.I......4....@...g....T-.A..\F..6D..&..2.:T?..@4....k...!@..X.T._...~.*.W..kcM.3....d......w.X.DYG.`....Z..g.3.i.D....]..+..t.......^;.Bk.X'..NG...u.#_......Z.eh...3...].d..>v....e..6....(l..1c...r....4.%~9......S.......$...I..{...w...W..E<)...n.{.VHgt.....)..$@.O.....'J..$.PV$G..}.A.....Z.Z..q...2.+..C..=)~#E..Z.c.d......rR.P..k...E._.....~.P]^\wI`....#8k,......;_..Q...]B..gn8;L...d.Q.u.9.n.r...^...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c1584dcc-8d57-4b51-8228-9d3d07661761.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6813
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.97440866941783
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:75619F2A628A5AED7481BFBFB642C4F4
                                                                                                                                                                                                                                                                                            SHA1:8BE1DA11323AD09E49D0DFD7E3D95BEA28918DE5
                                                                                                                                                                                                                                                                                            SHA-256:44266607B4A82F59BB356E6D3A491078CA957FED319E884C78DBA2C3D6823CD0
                                                                                                                                                                                                                                                                                            SHA-512:F9C9220815E1D3A23AECBFF5930084336B4D85BB09A4A51D7857D8C80CCE3482372437C72A3F4E6659380319F72C779D6BA61D34B5F2E30CFBD1BA1E1A8E836D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XuCHi9wGKW5FbP1qZzLg7n9S3O/2S0xbnxQeDjIKkItc=.....i..R4..{."W..UM....(&ot3.r....]..N.]Q...XD..|..=....J.l.k.vd..1...}....,Z.hf...P,0.....J...>v9q|......M...../..3..*=.P..v........2..@x...^\.Z....d..S...F..h&^.E.w.s5.9..dT...E.X...........W..RzU)...I.......G<.....?.'......i..-.p@^LV.9I..';..8n........7.*..5K..y%q....dhM....X..*U..^..<..X..e5F.1..+........OO:.T.Ke..M.i.r..I..#.......?..Jj........$...E.Q.7..K..3-&....^...a.R..a...q...).0M1.31LM..S7..].v.2z.8...lS.W.iM...*R_%.0t...,.~.wP....cO9.....G-....Z....y..5.)_.6.F...HS.[uP.pZ.J.2'f.@/H...G*j.~..L.?..4.5..u^%.[..oo.......0.........AZ...v..Q.h...3AN.....k..kol......Q..._/*.@E......e9.*..-DJ.K..[.q6[..n....tv...y.Q.{.qG..~f....U..<...6.2...[........~M.........._@k.+a..%y.d.... .9.\.I..;..M.4.L.[.s.q.+..gX.D...(vd..3.....y..P~..........(...)....Z.9){.N.+.~p.cTS.i...e\.#...fz...\.x[....LZ....Y...2N...5s..3..V3....(..N..C.hp..y+|.{...|./..o.{.......jD..3.F.H...sU]r.....+8..`4..~...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c301d50b-e4b7-4b06-8856-1b5651309d30.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7469
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.976780691863445
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:BA6ADADA13F219072D65337E6920A5AB
                                                                                                                                                                                                                                                                                            SHA1:0A94E4CB1DA781BB8A9C5264FD4E56DC9CAF9F1A
                                                                                                                                                                                                                                                                                            SHA-256:6B5213A64BFBE2BEB46A9473A7C275B93424AEE2508C397031E66D4876228181
                                                                                                                                                                                                                                                                                            SHA-512:94237570337E456067FE25EF88FF8F1F1BF43B8466371C9FD827AB744913816863454F87C08AC70537D559A1ADE1ED3B26088115D1AE9E1D5A95EFFC33FCB723
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XG2Zr2Em3nqqTa+4ECQmqPdCx/vx0AesQxvUsqNEdchM=.....s.........A|_..[@.-3..%>..}1........T>....S./~.#NBt9'.!.X..R.:.TN..v..W.&.{8m.....4..<\.]{_+:.._K...C.........Y<.^P@.L.r....U{.M9j.M..........R.&.*.U..z.5.@.J.!.N...P.M..c3y.>..A.-xfyc.k...$R.....Y.5.@...p3{..D..E..aR...]9_.........8....`.....`.x...L..7...s.c.....>.(..F.%&x......`.y...........*...B..8..Tw..T"L?..*V.,TVN.).M..X.U2..a;.e..&<...Q...GFOL.....B.J..,,r.0..k..*W_...~*.\.&,?......)........|......PT(...3.....W.2.Sp.cL..N.[r....*..1.Q...T".N7ADY.B....NXP.(...x...=...o..Yn.7......././...=..`.!.m....&..pU.c.r.6v.W.L".]...s...N.p^M..k.*.k4...'...f,...o.S7.U..1>.....T'..9....:....0.BH...[.1........8...o..%X....V.~.?csn...Z.cNK.E...&Aw..b..mX.WB.y..).A.H..<PsJR.......8...B.z.8.S!.W.;o.r.qx.T^]..p......w#Rf.;S../(6.eM.o...o@;...0.5a."4..Z.a.....s.#^.%JJ8..!.T.U....!..N2...lr..7j...........Pv.....W.s.[H..z_25.W.kE.N..vB6...L...6A0...oic.E.Z`.`.P.:.p..@.E`.81.I.3......V....A<

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c4332511-f4ef-446a-9eb3-b4786abd14d6.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7085
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.971299086460381
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:98AB70A085473E2940E8291CC8021FA5
                                                                                                                                                                                                                                                                                            SHA1:C583F4E887079EDE3825BA95EEC45DEFFF4D148B
                                                                                                                                                                                                                                                                                            SHA-256:3505734E1A1DDFCC924057A47EB6E47487F618678253A056F70E9808F550D2B0
                                                                                                                                                                                                                                                                                            SHA-512:B83BDAC307F42FDCDC83E371B9315BF1D8B7B77A54EB60E3DA415E4676AA2F9F7D428A25E1099D4A05601103CA76D38C8800562A238035D7506AE708F9986162
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XYx5hPZIRsXzqiSug2e7LWWWcVl/lXlDXgudgiVPytSo=.....m.<]z.n...h..t."t?|S."..P,.!.[.0m..e.hH..%...B....;.e.nl.1.5..._.......j.=.:.wp...mj...3..PZ.....*xX.0 v...l.N.t........D.{.!pF....\.%y.+-.X.1.^.....x...../....f...p...x.7.J&V.^.....}P.&.2.%.z.;.~Z...5.b.)V.:.....S..#..|.0.._%..D.}x.Jc..~W.aR8.....L....<[......+.S..<..+!5.&.,.W......H..7.[}&1........R..@.P....$/....x...7.......!..*0#.k.d.^.oX...\...\.vn.[.e-.>.,.H.@...(..U.d,..]9..k.l.k..Y(..........h...........c..C`.Y......qz.....P....0..>...P.G.M.H^..>@.2..w...{w..fi........p.fi<..v..Y......#.G.ic...0...B .n.=d.S..\J..=....n(.......R-..h...m...[...370.|..OH.......0.yUh7..t.L......U.~t.a.6^...)..p...8.4<......,....[ c.x..@.....\......|K.iu..c.t.o.{.v...!..p..XM.WU(."...t.R...+....A..."..h.8";v..=3..:.2.....#y..........,....{.k.W.M7u....@.G?Z..s.8...zBv....;..........-.b+..q.\....Z\..?<....i..s..@.....n.ot...)...fH.....5......3..Mu..9.....=.7.?.T|..Ub.. l.}..UA...L1..*P..6X..3

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c7deed59-4740-4ad9-83f5-acdb5fba0f70.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7645
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.976322291559107
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:3EB6C90DB3E7076A41ADFC3D63FCBDAB
                                                                                                                                                                                                                                                                                            SHA1:D937A6E3D99B273B126FCF62D81799350873FB7A
                                                                                                                                                                                                                                                                                            SHA-256:E24112C30E7EB9471A675DAF2137576A765E1D8981826815ADFE6722940D1B11
                                                                                                                                                                                                                                                                                            SHA-512:2DEB0BA20D5D110276CD5B6A7F706F938A77642893EF14E01642C251D6B6C04D6DF05443E1F947709880F9AC4E6699C99CC270D8270A10CBBD594312855C884B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XNDZM3Gu8XxCwi2sIIl7pC8766UXto03mwBQ9uAhCwpg=.....vg<E....aU....@.t9n.....v}.._..Gm@$....A......OA....GAj...o...l.m...3...7..G.wz...L(Rk.u.;H..s...`qx......(.Ty.g..A$.......<.`FtH`=.`..8....dff.d.....?-..W.\;M?I...._.NI.J..N...~5..j.c.S.x.o.5W..q_.\~....?),r......?TFv.T.m'..).....<n.....p./....2....jY.!Q.i'.K.?...D..^......2z..B.pp....l. ...........l.....f.~].r..5t..v...ku.p..c5e(.m....].......%...,..p..E.q......`'...N....{..`.t.....j..x..0.D........p.._G~..% .A1M-......4.H?.m...tx...:f=.._..1...Z.q..C.v.3-.......2.Ox...O..q*<....^.WP."B...8....h.....p....c"s....[ff&....lH..8*.SMp1.'..Z....E..%`*,..V|.@[*...jY..E...nwG9....4[.?......~.C...wZ.H8D...V..1..z.!un.......o..YG.+...hq.#f&}X..w..(.R..B^.......H...x..P.W&U..H.j....W2...g..8@......kB.....F...b.I..p3.....Kc..8x.Rj...I.z.>.d....K....;?.Jg.rb...O.....q.[...P....L].+70F...%-F...VM..7..lSw.E......Po.{?...u.r|.g.n..<|w.jp..J.Z...l!'F....e.z5..VW..I.V....O....g&.4;\..w.2e.W./g

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d0533d6d-7c53-48bd-8041-a866bc73b0e0.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8173
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.978571530941727
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C724B1A6315CE4C9EA9BE488B2EA5B38
                                                                                                                                                                                                                                                                                            SHA1:63C2FF1170C133CD64E183537FDB9CEE084EF8EA
                                                                                                                                                                                                                                                                                            SHA-256:D35E657DCA13D1DE5E66ED3FC0C473D341A38D4460DF938CF5EAE19FDB6D5657
                                                                                                                                                                                                                                                                                            SHA-512:96A5DF7BFAE5A3C54F7F513AC3BFF721C51BF31C5C03247A4458FA5E3C9D8EF2174EA11AEFBF4FB79DDD3AE12882ACFDC46A716EC12A633A863D3D020E8D105B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X8TgbpnBOOl7456FPxCpRfjH522HEr2GbNRv7sN817uc=.....~I.?r8...c.R..J.$)g...P....}..w....8...uR.....R...n....x.d.&.}.{_Z.v.g.br.;u..W...a..T..b..S....1.........KV..h..IJ...n.H..'D...U.z...U....Z3Y.0......|.....n.]..,......K...b..~.i.?ks..R?.e.8U#....t..=.v.\+4.........{x....\..aHd.H.#.c.45.]d?,M.'.YUw...H.j..%.........46|...C.0x..K9jU..J......G.~.=.......~H..bi.q.I.\;,...5p(.|F.sx1..i.P...<.........9Rc.....pd..(..70x5.^..B0...-..4B.H4..}?..E..K..%.;.*...f.isZ.K.2..JD.:.A..I...X.XT.*w..l.6.....|....+.....1g./..".4aw......a .iwN.n.G.v...n.u.d...M....K.P.....1...#.^.\..{@.lcm.[..D....on....tl."..D.c..;...r....QSg`..9.1.nJ9..p....aE..j..j...u.p...S...UB.9....J..."2H.u...a:..L.2..e..F.9.c.'.P....i].E............y..v.66..#.I.4..\..m.".G~.q2.C_.}W.<9...H#gH..".r..P...'..Xs..5!^'...1..4.W.H...(...0..kD....j" ..$c.a....{.....C.zc...#kHA ..vfj.4..>P.........K+...vc...`t....#....G.t@moyc_=3+.'2Vv/...sJ...[.."....$...F=o..R...T"..b"|.......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d1938a20-b7cd-4e43-aac8-1d4fb730e36a.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7789
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.976269908151791
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:BF75B55066C4022AE7FB60CD7BB16149
                                                                                                                                                                                                                                                                                            SHA1:90CEBA96D431A7EA78FB1B6F9B21E7E0A822BF8D
                                                                                                                                                                                                                                                                                            SHA-256:69E08DA98F52E5577E66AC302243335D9E55428651FC85D0557275AB204E389B
                                                                                                                                                                                                                                                                                            SHA-512:AC0D02F004AB084EBEF42D75EF14926563D30D58DE8BBB623CCE9C150FCF3ACB29F62417D56D1773897BAB61E3B3A6199EF80BD90D943A6F92D089B8A7753952
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X4trcvBFt2xvrgv39o8qykNcNcdVRbFN27f+8Gpcc1A0=.....x.Q......v[..5zx.T.Y...n....X....VG`..#~.}...s.T.9.#n...%.,.......T...=XJ.@.z9.d.m..`.f....{.p.4)MMc.....*2~%..$1....|U..?..l...A..: ..c........._fs..2j...F,Z.R.m...a.Yk..4...... ..5...sX..lq.x.9.^}~l..DM..wH...(..Q.9...>.....>...}..V..F.GK....i.......9.u..R...bRBu...H..}tV...&..CS)..Z3@... sk...?.7...6;te.... g....#!.b..k..9%.x.y..;.......T.z.k)....2..Fr.p..NNrN.=.B.9.2.a..$..LLkA.sT...........f].Z...q/......."?S.fO.....NEV..j.ht...1W+M3.w.-..ce;.SUH?.P.*K@...-~.....W..S].j.............. t....h.IS........[..M.."......L.Q4....n?BwJ)...... .Y..Q9.do......_L...u.A.x...X....^VS-.?!..a ..Vg..)Jq.f.......q..b~...NL ].~""..7..T_0...g9x!......,...!.t,_.#JA...loq../.v.J.V"...!.N....r.qC>C.aQ.'.u.....><.,.C5.L..&...fBMCA..;&........T,.. #SMw..S2j..*.....ap-2k.^.6.E....e_.WL|z..m..*?...Z.Y..a.*K..E.)^I.f...|....l.o.%.}g.2...D..M..$I.jj.OH.}....)....b..+P....!-.).X....u.....1..s2.....>%...U....~....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d719efda-0723-4741-b513-335939851ac1.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8270
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.974282623299024
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:232B2BE5B2D2216B48EA3993A1850EFB
                                                                                                                                                                                                                                                                                            SHA1:98EDAB902B632B6A1C65B86D88EBD0CE640EBF5C
                                                                                                                                                                                                                                                                                            SHA-256:19AF6911EC1FCF33927A7DC196FDC88ED09220C65F19F13C9723BFB22002AEC5
                                                                                                                                                                                                                                                                                            SHA-512:6E712F9C38F9E8D3DD84D5E9075BDBC8645852B582685C3C484B4A97CE10D9188C8DFD7CD65934E76C69DE591A567BA7DCBA97CE9F72CA6BF2D8A9A72744A7CC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XEJLTlRt2Ri0QkTnLRPtBEu03EbUaTtaO4Bll1wqiP5s=........|.1Q...b..Hk.{....G.....@.U.._.S...b..W..B.x.4..jXtA..5eI. ...vLM.......{.......q..U...t7M,.....<w..T..e.l...{.K...k~w)..7z...Q....................M.t.......u.:h..Vp&..x....b6m.3.f..-(.rR.?XY....QG.L,.......a...#|.x.'........q7.. $.=,... ...;S.....vN...+.6.U. ....y.4.~J..t..OrT......... L...Q#....~Jc.....1(...1.c.....o.GO....&..._.j.../..........8hoFFm.i.....=lEJ>.X....>...`C..."F1....B|....+!)pq.*Wb.I...m0<.O.u...l.(j.SYAN.f.Om....|[....\o...)b.32.)$..e.\G...u.=";.5..)...u..4MFY.K.H..0ov.0...[..,..%..@s...AOo4.b..~.?..GFCz"`}/....._,..#.p.m.I.0.[..!T.y...u.-...(.3..."..a..UK.{0...(...C{....y.c.R..D...1.4.m].....#...ZgNg0..S.......zwV....... B..F.G4..|.a..h.@.Y........B2f.....s. K.uH..._x.......o.83~.w<....Z.....~;S=m..1-fA>...)@.Y..8i.}c....J...N.a..L.1..iP.%vR.:...!........G..f=O...ne...."...'./.1Upr...7..~.`....r.?...Bo.""...L*s(X-..E1...}....o.cz]u.G.2P.[.7.?]...8K....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d966c874-86fb-4234-b0da-5a29b3710dd8.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6925
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.970064675321407
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:DBCF16AA4090FDD34CA40A4802DE1996
                                                                                                                                                                                                                                                                                            SHA1:73592BB30578A582ECF58B5166B2A701C8D0042B
                                                                                                                                                                                                                                                                                            SHA-256:CE8B7F015559D0E180BA006027005C81FF12CCCED08BCAC49311397B31851240
                                                                                                                                                                                                                                                                                            SHA-512:8763526A1BBB7E7341D6162B706AD4EB4DC498ED675C9AE858748C1FE4EF10509A3A678E85B143C394A17A15C32DD1B8B0BAE5ECA8A6C247638E3148E366EF97
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XzSvIaUYxiw1zgE4WS8/TJ+Im7s23Se/ehZoGTzAvhwY=.....kC.Xa,....#.Iz.I;....f...t...z(..Y<.8.....-.&4..}..Q.0.'..w/.......3.=.(Fw....,.}......X..v...>.......^L].6=Cp...M..i..T.4....;.yr.r.1.cA2Q..<...cS...I.=O...g!]....vD.....].5.Wr..I.W..... W.jw.L...%......V(...W.()O.>..C`.>...J.K:8f...!../...O..T...J...(......aT...Ai.....d.iv..I........r......o.Jm...x..;.{......v.@:[.*.S.2...=.5{W....M%....h&[.r..j?;.sp*%6.Oj.x...Xf...#.........\.CP..+..;{s.....>.9D.Z<W..........}../.2."....$..>j..<...d....e..R..o.\..Tq.c.=./fp..!.T;.........m...C.........P..:..J...4s}.v......C.....D.A..........&..]..#..o..C..%.sFauJ!...G?`.q."..).....|.q...2h...i.GH...pAK........... ..h..3..R...\...\.dOH.S.Xg../....'B.).3^L....D.-0..A......$...4..F=.YO...PVC...V.E...........p......{[.q9~......A3.........{.A.._...)....2'.,t..z.v.....l0.".....x.e.?i....]Za....hoV.y.S....8...O/.....s.eg".....\.'.........{.F.W4U..BF.,.......<.5..N.x.n.L,.v?.$Qn.x.VLc....Y.4......O.=].iZ

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\dcb8cee2-a947-4898-9090-11a8d50c1bfc.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7869
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.975011430725471
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:BC1580BDA9290B02996831C9A2F23485
                                                                                                                                                                                                                                                                                            SHA1:165EF2B8DF0B06DBAA37A36BC461194A45AF81F9
                                                                                                                                                                                                                                                                                            SHA-256:FB083CA4BD60409D4F92F1CBA65E3B6DCFE9F1DD92A3BDC254042DAEFA67F03D
                                                                                                                                                                                                                                                                                            SHA-512:6743435606E52DDFDF76292EE7D55864C80C344B80E81F60F836CF6AF5BFFBBAF0DAF3F5AC2D0A0C02102DB232A2790FC2467099BB482CC3134EFE5C47FF313C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XTx8LK6q27jDAF0YWRhd2nFqOxyzjbiIf1oqrGrGxHEA=.....z..b"-.s...r._Z#_........./(J...`.HX.?Gk....'JY..@....Pq..u,.$.....+..f:A{.2o1...R.M .........D.........!H..o].0..(...K....F...c8.A.S.....9..D.*b...|b...E.K\S.......u....lRK.....,.Y...l........C...e..... Z.O.>y..x.....#.....]bE.Go\.g..n.._.#.['tf.k.R..m..|3..%.P..3.o.[."..l.f.[|../nu.......;....lD...k....0f...^...E>...$..o9...... .......z....l.`.*...N..2.e..F."..........j^PF.i..^.{....9w..H|.(.<.E.Y..b....1?.y.._s;f[..-...h.o..!.E.a....(.:.y..0......^..=(......Tmru.e^.zO.$..`p....0[..r...v.5VPD.o7...-4..K%0..)...........gD.f.$kP......*..g.\.|...xo.(O......z..LQ.uX.....3...1..6Q....Ez.p...../.O....T...K..%6.x(..V./...k"m%....8~....9(uo.R1...fI+....Jq.....K..;..{H.U[.EFT-...S`@....yp..v....x.....L..o..a....W..@.\.6J.%.w..Dq..a.U..>..L.a..4b\{.....9.<...%....n.H...}.fl.E....D.UCO.i#.q.qV...:..l8.Y.1S.uv:.|..?TtF..9%...F..T.a.)w9_.....u|.....MQS.ok1.{...1M O.'....1.YM...\[.oD.`.)#...gB..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\debd8443-7182-4aaf-825a-7984631308bb.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7837
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.972721140741311
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:E8114E5638D2D75FF973CF1A32713135
                                                                                                                                                                                                                                                                                            SHA1:D8BF7FFC03884BF23F4F4D3A3301E0E7FAA02584
                                                                                                                                                                                                                                                                                            SHA-256:8B64E1F337189392F2DB3D0F764EAEC9A7A2C52E1EE9C51BAA93BA3774FC8A6D
                                                                                                                                                                                                                                                                                            SHA-512:F4C07CE0BC1CD947779F89AA4A660A8467A2D2D32897A717552C90C732A8464C1739FF2967209736F21C3029437B34831C5C68911A8323BFFFB0F1F72C7982DA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X0i9ABvvyWsdghZHf/shJnzuYOnyXVcZ/s+8hUcGkFh8=.....y...#C..z.........G.i.3.n...0.>j.)d.5..9GVK.~W.G.`.........,...SU......b".s.|^.|.....Z...4|Vc.......z...T..~)ET..L.# 1....l. ....M...H...q..O05nc..h:..2......c.....v7..I.....v.......w..Q.....u.._`.}..S......\.^A9...2..-.t..*Z.r.#..l6'O.......Y7..dv.G\e....!.f.c......c.!.A.>E....u:.0 J..%!..Y.......U...p'.....:z....7.).....#.3.NHI.....+..X-.4!:.-H`eO...X..i...VN..lAi.f..8S.....0n.....Yv=...3.%v...`#&..I.|6.x.Z.PA....yu..b..W.:,.0>jah7..?.m(0=&.}...Y.M".IV.....]FTL..:.j.!.C.%.%[S.o.gn4+..V..*{.......dLGE-$_l|,.n#v.b@..zJ.....^..Xl.Rv....-*f..$'..."#v&..I..hC......;.....p.........Bi.0G...ZD.^B.S2...|!..=../hu...!..O...9.......COa1.:.....s...n.X-!..*.........^...v!,.|?..\..VU..k,..sNbdw..@A..s....%.`T.^b...|.....yA...(..K...G.ct....{BI...R..=.".)Z..........gw...a.....6+.:>2]d.G......vKC.........e`.....d.W.Q'...N....-.TB.....S...n\..7.4E...{M2....@..2.^.W....R..2..>ftY.v./7]NB Y3..o]..L..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e0a1fd61-c93c-4c8c-8bfd-9985ab7b9d09.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.977881655896846
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6F1DAEBBE17ED5E0B040430D562AA076
                                                                                                                                                                                                                                                                                            SHA1:86B75238F2712F1B503CBB521F40D45D005686C9
                                                                                                                                                                                                                                                                                            SHA-256:3BBCF1EDEAFA962938034F23FCADA9D307FCAAD92710A9A1779974581AA6B765
                                                                                                                                                                                                                                                                                            SHA-512:154CEF2CAD85494A2B3EA12444083D5A185D3D20E124EF426A71DA1A3E221F34CEE4CC4E1DE89782769DA0932128B5DB4911CDE7F62E1C9891B54E641A16DF4D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XBBGxIyVkUNbIFDImaV8e2Z5nJV89288iw0f5qz+V390=........w..Y..ISt.k.X..CP?....^].-.2X.LV.~.7.SOB.0."?0.3+.h..8...'L^9O...c.[.@.|..&.A..$._....D..].q......='[..6.F.....cL....)Tm.M.>.n-.D..c...v..3P.....'.m...N.j....8.]-..2}.g.s.....,w_.s..`..I..q..........1.....T`s7<W..a..,.'/.\..v...hAcFj....#S?=...<. K...j..*}g........GX.x6.N.p.b.HS.|5G.K{!.....tE<"..p..r.8.V..~7.AKc.GI&7-M.....e.....sF...7CyL.......H}...c.11F.Zz....}5..(*?.#.&s# .X...N....@....ni...;c....0......4.d...N.o..hY>95..t..Y.%4..QC....N?..7..Fq.V0.U..Z..K.'..G.j.....,..u2Y.].Z.]..xM..i:.<ydr...T.}.:......P`Up7..AN..I......I.~..1Qsq..e...2.Vt..=.FXHu.{..t.'j..f.v.Q....|.c#.6O..x....3...._a..4.5L..r..o.......g.;.`..&.>...hs..\..M..l^.........af/.$MOb...f.j..P.z. .........se..bs1.[%e....6.d.1!.`....(6.....i7.........i.....f..gz..w.-C.5...x.,.A.......2"..S.V...n. ....^...h.w..1E..a;......Z...a...Z...O.@_K.......oJ.cl..\xg.s..r....|..'W.........../OC*...z...m..L.......%v.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e276fc0f-4d0f-4062-a261-2c7c756b4700.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.973991627397689
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5DAD6E966B44E983F2232830C104152F
                                                                                                                                                                                                                                                                                            SHA1:DC64E031DEE706E93F266A990380B1BE64153B78
                                                                                                                                                                                                                                                                                            SHA-256:02A7A3394189B4353C4A095B406108AB5C0FDF138DB83E677D219BC55A351B16
                                                                                                                                                                                                                                                                                            SHA-512:68D0EBCDC6223270921EC8F0E8A2DC79E5333803757B0A4C8A4C41D2A1FF47DF98D81BD2E9601515A91DF1F5C1840E4518BFEE04703CADDEE5CBD19539ABA917
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XLHYoC0rYlKCKd8iebuldomo7fd4RQpTcsnRngca961M=..........i.......G1...?/I......F.Z.O.26p...a.k....5!l.z8V.c.....)r.fO.*....ZT.1.XI....>`.....+.$y.....gA.V....xL....8I.p..........q$..;..!.T)..e.;Q..T.M.c9........6-.....F.8\..^G.E>....w......S..b4../........|L.H.Dq......v....Ny.6..4).....L.Rr..< ...Y"...R........C>Z.[.c.W..}g...o..u#.tIw=...(.".R*.... .[p'e...F.._.P.X\...~k."..u.W%.......4..>9.!....>9.$g.....ECR...U._...T...tV.....Ec..W!...;...k......w[. _.sB.-aN..j.".T>&....&..v......H]i..T..15.Y.h.....T..3'.l..M.6.0.9.BI.....$,.S.T.75>..ea.L.D.z.H........f.n..[.RC?..(.BzO.-..%....W..RD{.x=..(&....5:V..@.f.u.9[...rV.....T....=..P.B&Vs....k....s8Q..;t......hF.+M..b.@..KJ.^p0A9.'.....m1......@.~../.j...S.8..m.k.Bto.e@a.u.......>9...E+.... ]ekc^.&..Bx..D.sp.h...`@!3,;7...}pO..........9..).g..+4L...3..t.|)........,G..-........N...08C...ad..%.l .$.....s....}.P.&'.O.!?...xV...nzO.v~t.cX.....~....W..:.]..B.!H..G/u..YH........\.?d...H

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e64ea7f1-0ae8-40b9-a129-b1729f934643.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8013
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.97851088070076
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:3E66B6083A0ED479B55872FF88D5D86F
                                                                                                                                                                                                                                                                                            SHA1:CA9A1412B84BA411D7CCF5ECE5167939535076B0
                                                                                                                                                                                                                                                                                            SHA-256:11459A500E13E1D3EFB4B1ABC365386A0C5CCAC1DE535684CEC148294C8DA549
                                                                                                                                                                                                                                                                                            SHA-512:A47DDADC5FEC5F5F864C0EF8B9833347DEAF7AC9A607C5917C7BC385D5B86FD529B4135D73B2AA739803D888C3DE91527317AE3C2DEB9C859D6BC74644C80A85
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XxP5gbdcTnXZHRbAH85qXpbet8BJDaBReJ2pZJa30QrA=.....|.....,K.K.2.\..c..-......*...s....:..@..F..E.s...LO.T.......I.s3....ef.....CF...a=]1...T.ZN.69...P...-^.><l.`>@......n.z...Yn...c....).........|.D..=.ub.k.+$Z,F...#B..Q..;'.y.>0c..,%.P.......<...b.7.g..%.NI/...R,[.9.6....E.m.l..O..!.K".q..X@v.A.@W.M.bGM..].{....{0m..P...:(.5."6..u.E.F..e.9... .Q.T.Nx....:.#.:.F...^...3.E...\;...c..wq%...BP.... ..#....R.........Q....M.[..;...6.T.../.R.E.:)5.E......'.-i<.K..%...A..5l..U_.^.zy..S.$_...p.k..u.El...)..(..u.......V..r..Z)(.3...Q.b.C....s.@pQr...<|[.j.G...+..D..N.{..\G..\7......a..5.1.p..#.OXv)...k...V.tAA..}&..h..9..K...f...Zz>....V.j.5.,N.j%...........8....PTGe>.:6...:.o..{...Y..{<.2.\.Y.4,90/..w.-.."....=!..l.~..;..f......iaOyd/..M.A..k.........nsS.......t;.l..8..y..Td....z..P~.W.j.?..! .......(...4....K\I....n..(@.Q^...T...}6"K.y..s..5;...H.....0.0D.H{....,.....3.e....`....P\.yg).........:S...X...xW...nx.jQ|.:.Ao..r.vA...vm.`...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e6634032-f18f-4c33-a55c-45f3a1a161a5.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8221
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.976698366942039
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:1DD8BE5D94843936F7A7985108C6A3C5
                                                                                                                                                                                                                                                                                            SHA1:3DEA282B76BFCCF158E9C0B2D4A2A1C2F7DE25FA
                                                                                                                                                                                                                                                                                            SHA-256:51B2712644CBFD8BBD1A27DAA9D984467E673F8A507F0A7F3FC86FBD029221EF
                                                                                                                                                                                                                                                                                            SHA-512:C26FE1C2166391001AF78190C5B1B2DFBBC25253D7A74366A31E3B3E681A9B593DA692596615ABEF499A2573B14FD5AF977BF2ADC618E4AB709ACE2FCBB56FED
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XSeQR7l6bHxcCr8IWYXwx2XWIlv05tBhIpMZhgKrWS/M=......=:..<5.9Ku1+..X.U.?y.g..H.yS....B....N....Rp.~..k..D...t.SGb.[..z.].t. !...Q..V...n.a.Y?*.%..$...........#.......CH...#./t.z...."i'...#.....Z.].YZK....E}$.U..(<c.....lQ...].0U......w...RX.S.*..0..`..ep..:|e.$.k.WQ../...cp...s.0..3..[....f.3Z...XHe....~...:m./....:.......p.r..0.......U...&..-.Nv..j<...z.R..c..........+..'Z....a..6.......=4a2F..%...{...F.x>F.8.Y..^....8..P.=..B..;.i.6t..KW.Q.u.G?!m....CS`y..\.3;......r...<U\.S..7.Y..}x....\.....Ll2.. nT..L ...*......p.0.[>.v._...9....).o...RA..@.f2......U.......I......D.O........n..-..q..?n\.i.G.+.G.7......aK.]..8..>..&........X..d.@F..JY...d..~Kta...bj.#..S.....2./..U|..%.8..6x.c.F..T..X..q..8K.+^. '.4...5.`e..IM,J......|VZ)..0...kx..wk.....:..u.L2.h..6..k...5.?.e....).........#.........'#..E.0p'<....Y.*.../......H!).>...b.-.Y.S.<....r.d..Rol[Y.d.PN.%l..tm..C......*...l... .}...L..a.....=........x..EF.......C.....@T..I

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\eb56cb6b-6a03-4a43-a921-83c2072d6012.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7741
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.978216671912773
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:F872514EB5DDCFE2CB36A70B596937E3
                                                                                                                                                                                                                                                                                            SHA1:9096C923F9136FCF4189983A586FCE4E455743D3
                                                                                                                                                                                                                                                                                            SHA-256:26A47E9135336BED84CFE3E4A4CFC54F955393A76F785E694267AC7F128371D0
                                                                                                                                                                                                                                                                                            SHA-512:869517E5C852E96EAE7B69DB7541ACBEDCF020E7FE943EB797CC9F952CF72F099B779C3C36B97D4301DC5B36DC99BC4E8ACC10A3CD71F488E7A434922E9EBD53
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xr/bm36ohvrZQlwpLDZOj4pmYMy1npeRPF3CRhFrLBmc=.....x.g+*w?..,....h_.e.5b=....j.......O2p..#.A..}..oZ6..}j.....P-.......;.(._...b.>`..G}nl}.<....^.0......v..Z.}....)p.;.R...O.p......?.@..........[...)....P@W..--eXI;.5.U....`5H...7X5.n......x..c.....?M.W......E.R.u..d`;....?s.Z..}^..j &g.1. .)..s.\...je.T8*.d.aS......L...^.....I.......O...j..........<b....)..5.=.x.F,...u...E....P...q.#..2..F..I...T..........>...r......3./..Gm.%C2.W{yC`N....>eh.$O@.Y.]w..)R.........S.3...O.Y7B.s.g.O.L...Y........?.../:c..=..q.!s..aBp.W..yGR..qD[.].....uF...:.../._u0...9|T.V.b....F....u.....O..q...!;X..$..a.Dr...T.../A.;....6W.,}..{.\X|...:..'..<M)PG=.c.S[e..C...*.'.z..T.\.....K.I.%....M ...Ed.c%.V...*}.......2..\@S...Iw.3).)..(....b.<.=........\F..hN..aR........)$.A<..#.P........T....a...Q$..eO...J......b.......}..[....Z....).Y.Z.U.}#N...ota../..)....`...G.T....f.....D.i....p4`T1..v..2.......a.~....:I}@.hk./......v......U....^.Q..m...y.7

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f019d3d4-e602-4939-81b8-a25973778a5f.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8318
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.977595237149431
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0BDF742C754C478E820D937925FF6EB2
                                                                                                                                                                                                                                                                                            SHA1:B72DFB986B8C06993DC77EC67A24C04359089054
                                                                                                                                                                                                                                                                                            SHA-256:777A581A491F12D56260BE22AFE6F01F765D35F91217AD3FEE04C8D36EA4BDE3
                                                                                                                                                                                                                                                                                            SHA-512:D84A79214F20FE7A8E0EEBE5E1374D50DEE8974763F0E4DD9E6A1CEC7570752AE120F7455ABDE45FACAEB0E106097DE44357D8F6AB0B629E1ECB8595D415A932
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xj5+mkIPGMZ/CcGGRO285H0HE1Sajt5oJdDBEXkcduk4=..........G....g..G..g.*{.....#x|.:.[;.l.}.....H6...J\X=.@f..q...=.7..'.^|..[s...`;|.l...x. ...+.."..~L.C.....@C..`...j1o)..4...I.cX.b0.q....87.g....=.P6E.U...J..W..T.>.......]..f..#s9......<f"...(B4E..I...Y.k#&.Oy.}...M.......@.,.>....o.-$...=.\..3..X.c.,L..S.N..\)q.........(8..(...%..v.".T.&.+.(.p...~-..M......8...Q..p.|~LS.e.h..&t.~..}...z..i.x....R..a...KB.....M.s.X.... -.f.z........b.HdO~.&.zl.%......}.G.'.X.WK...>.5.H......x.N;...2...J.tl%..2.-I>..p.lh....].q..V...?.z"U......8..=}. ..4..#{...R.1.+.I4x..h..9...<Y.]=u..*.O.Q.v.~..dq'..g.M.8...O\.[=`d.....F..X.. .......fsR.Q.`.E.m.. .O...S.b.Q..y...........7....An...-....+....D..GO.....a.k...A\.....%.[m..;..7......6.b..u.0}a..:&.$#._..9.f3L...\!....}..o...`...Q].E%po...~.GF../...Ci..yYSrf]$....m...R.;...Un...@...$.@{....<]...}!...ho.cx...<..1..7*_.P...zNA.lg....s.....6Kp.t..=......T..3d...="ccN..FM......M.C..z.)Z~.X~..b].(.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f57b674f-efb7-4cff-b626-40dbd2b67756.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):8590
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.978501989464774
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:F1AF5E9A2F29D7B346C7AD839083A200
                                                                                                                                                                                                                                                                                            SHA1:C61B59B5CC09A99714F25FB4D7290CE04D73AE25
                                                                                                                                                                                                                                                                                            SHA-256:BF99D9C44D9126E0343D5B6D30A365CF2B441C3EED025DE6C6884BC53DAC62FE
                                                                                                                                                                                                                                                                                            SHA-512:B2424CE540DA2FFD6FD0CB704FF00BF3F2ED01A1C59AB7E90653861C20C00D8FC4ED27988F63DEE084FEE048FFF51609C58975F1D7507F6A97B356123DE19137
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........Xkr77IG0j9RuMXh3u6FVWIckuYAPYWHU17R8oRhu+Vq0=.......KP...6J..}.?.-F.E...9c....u.......Y..-..4...K*+...x.....M>.L...L..(..A.`.......W.....t..L.|.~.6p.......>\.......l\.K........$..3X?......<.J.........<......b........f..edp....|..2.,.:u.4..... ....6\q8..X[D....#$b.a'uZd..X.ft`5..|....l@...V....Md.Z...:...Df......G.C...c..?-;.Y.y..(.z{..(...2...q.........O.F.>.. .6..h$...f7....8?Gc.".#o1(ee5.>4\.$L.!n.5.@../....&.-%.f"`...vG.G..(ry.H.`......%....3..s..t.p.)..].XV..Ii~.......-...1...f.1.l..h...........$.a{.\..B.6......P......iB....V.y2..>..H}^..R._.2.......fUx..S...c.C~..U<U{.....F..b....... ....y.c...,e.........L.Rj....&.4-.E..........@. .....l..j.k..G..-z.........?.|h2.... .}..3......%.ZT#&..v.?......[......_.[..g.e....$..;.7...V....(..n.}..h..6..(.d..........h.g.m..3EU.......M...P>.}0.'F...YV.-SAjM..+.q.Y.m.};.Q.@..FB.'..FS....'.N.....P..DlM.$.nPJ>n.....V....Jn....*x.....6&..^X....].9"..:x.K..%.AI..l..)."..ofOD..7.. .m./.z..o...{.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\fbfeff0e-d562-4b7d-84d4-75ffa04b4e30.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1389
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.8627136354031855
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CA595AD35A9865C52F3FF9F4A0608212
                                                                                                                                                                                                                                                                                            SHA1:8B0F153DBB6CBA5E54BC5250FE188B49BAB9D8C4
                                                                                                                                                                                                                                                                                            SHA-256:2DB9CD6155E823007B43733089B57B51B6033A3722268376EF9A9E3A81649E98
                                                                                                                                                                                                                                                                                            SHA-512:3B0A34B304D6F567B67C9D6CB7A50C7E9FDD6BE4EA0D6417112E5C2B380A04DB455FA722EFF129A346AA62DB54B7C718C54D5F24589729F7D7C618194E137AB1
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XVayQPJ0v3eflKdOghbmWpf5Y7oEtp33rk9l7qjnBRG8=..........D.L."...Z*..O..\............I.3Ii8.........z......3x../....G....}..4..;..b.~.N.8.F&.(rH.....S...y..S...T....E...+......?...%=..Vw.~.+..a..6RVNR}.u*.?.'........3..8.I.:..z=.}%......Xb.9E..%9.0.R.......F..F$P).H..kj.#...x....'G.,bi....qI.X.........k....}.*..f...b_.R.w......_B.#..B.......yD...%.X...@....b.o...}........(yy.iv.! -.<..T|...'....F[..y~....$;H.$l.|*Gx.u..s.{.2._`..q.nc5.&I..+.|1..g..e;).i..YM..(].3e....s.@.]j...c.........#.....j.c<KM].jU0R.6.....b..4]..............,.`.../.aNPU.".\ i2B...+j.sTy;G.k...'.zn4.*La~.7.2o....%!*.FL....P.H....v ....`..$...d.....f\t[.w.....g...........+-k[..mv.l....x..x{....Q7../.7.~.=..K....F.k....I..............sj.t~3K.p.......(z~.ut..v....IM..-..+....r+>.._.8...}= ..d*..&.J...5.32E.I&.}2.(.G..}...'>......-..[.n.C....S..B....E._=..Z.!..<.mt.B......6J.@+:...x..le....?H~..o.c.^.3.%...Z.._=H....V.i.......#...C5.E..m.#..h.._z. ...i\..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ff0eb385-aab9-421a-ae99-1867a3dafb23.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):7965
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.9787352156247415
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D00CB44566945E1251E502C997BDB93C
                                                                                                                                                                                                                                                                                            SHA1:D9A66843335B065FC0927E82D30BE0503ECE77AA
                                                                                                                                                                                                                                                                                            SHA-256:05ED516EE1F9AF0BC74457F32CD6F7E5D49A609E848BAEB3B651C4F54B561420
                                                                                                                                                                                                                                                                                            SHA-512:232C61E6C88A068C12DD83B01ECD20DE8431A4EAF78450B5B47BCBCDE37410D51AF9EB6D794AFFA0C068BECE614F21847043296622DBF673E66F4DC3011C22A4
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........XXDk9iclBlb3NbsReVjfceUEEHT6Ah/oYsCQ3D5AHv64=.....{Q_.,.g>.....y..(.r..]./\$>A....W..C.f..M.8...p..U.|xs...i.j..+.K...L9L.y._.`..B.Lf,.:...>.(.'..z:...,H..'.........o..q...lKs.p.$.X..3..O.:.a<>..|<...yD(U.J....p.p...t6...k..a..<O..V.@@".hSg.|#..v..\...F..a..Hic.A .A.yn .R.G..A.\..z....O.#.....pp..<H(/./..C.....\.E...;..:.......=Xo..G.Z..........t3.....<.....X)U.`..eF.8.!.6.$.1...b)(I....P.7MR....r.G\ih...{.....E...{.....O......t|+=0..j....#..;.n....5.i..I....T.Z....Je..U..e..K..X.t@%......`,S...ee.l..|...X').f.)S+..R..U.......S.n.h.p.U...k.z.#.4.......C..U$.B...}.S.....l...F....Nr.G..7.....^....G.....e..sV..i..N..{..96sEP.H.>..e........A...s.)...>..j.*`..XJ..Q.L....'.s...u...^..a..z3(....c...n_....BR.p.AFMt..R..gX5.2..}=X1..aU.-...t.x.l..Y.U1...U..u.>,TG.....C..i..a....*|..t.i..,`+...6e.\.C.l..p..........Q.*k...'....R...e.....x'aU9.I.>.9G............c..&.a1....@...W0MP..W.. .t.p.,r./..)..5".... .J.R..B.x0.~H(.=.2n>.1......Ko6e..wlg

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d4f6f.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d4f8e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d4fec.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d51ef.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d520f.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d528c.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d52ab.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5626.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d57bc.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d57db.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d581a.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5829.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5848.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5858.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5877.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5897.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5e53.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5f5d.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d5f6d.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d62d8.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6326.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6c0f.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6c2e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6c3e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6d57.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6e90.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6eaf.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6ebe.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6ede.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6efd.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6f2c.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6f6a.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6fc8.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6fd8.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d6ff7.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7026.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7035.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7045.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7055.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d72a6.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7585.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7594.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d75a4.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d75b4.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d774a.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d775a.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7769.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7779.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7798.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7df1.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7e01.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7e20.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7e5e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7e6e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7e7e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7e8d.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7e9d.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7ead.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7ebc.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7f0a.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7f1a.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d7f49.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d8062.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d82f2.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_c068130e-df26-4d66-8c12-432053dd2a31.raw~RF3d8312.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):381
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.358048648454937
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A51A76ADD927B44A1F3BFE252992CA90
                                                                                                                                                                                                                                                                                            SHA1:080A9E80AAD5BC700968B039F3C41B1C97FF4BBA
                                                                                                                                                                                                                                                                                            SHA-256:BF4979E8A7B6DE5B5C9489F8F6123005F8EB04203A8A6B8202DD175BFE629953
                                                                                                                                                                                                                                                                                            SHA-512:7826BDFFAB5C824621FD0D26FB95DD7AFC0F38CB6A1B16DBC746234922A70D1F0B48DEEB797EB0BDF6060A37F2203914D235AF2374538F76EC068C354500C034
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........X1SRS1rX7vg2gaBJaeGEbl9cYCHUmUwucLccVOSqKHj4=......uWR....bG.<.....L[.ZL...Y.)..s'.4.T40i|.:u.m..b..}.u..Qsi..}.V..-.....r\.|z.....b,....\........`[O...9.ni.D...Yl..0......{.e....kE.....!.....,.. x..I.."._..[o.>6b.#.....$..sE..h..s...g.7...b..<.u..c.....E3..2...z.hi...T].~.kG.. .O..........u.I...O.4"..c.%..)m.@4-....Ls....u*.`'.` .V...vn..9.I.....HV.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):46
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.019797536844534
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:90881C9C26F29FCA29815A08BA858544
                                                                                                                                                                                                                                                                                            SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                                                                                                                                                                                                                                                                                            SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                                                                                                                                                                                                                                                                                            SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:...n'................_mts_schema_descriptor...

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):291
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.2250548630427405
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:ED5F424EFEC7401BC41A4A034F1D729A
                                                                                                                                                                                                                                                                                            SHA1:4849D69805B93A399B3A34846C06A7789B3FB1F2
                                                                                                                                                                                                                                                                                            SHA-256:A3078BC2D1EB0A2DB29DF37765F34530CD240E0F48873DF9FDA92E31F974D768
                                                                                                                                                                                                                                                                                            SHA-512:D6A4D6555C0DC1CA8B8279BA7DBDEAA8A20963C9821A3833BD0F975F102C941DBABB45D61B257EE4E4CB0CD04C31DA4EA5E158DB8FB475CEF50EACCDC1204F70
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:48.275 1924 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB since it was missing..2024/10/29-10:38:48.343 1924 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Variations

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):86
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.3751917412896075
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:961E3604F228B0D10541EBF921500C86
                                                                                                                                                                                                                                                                                            SHA1:6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
                                                                                                                                                                                                                                                                                            SHA-256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
                                                                                                                                                                                                                                                                                            SHA-512:535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Visited Links

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):131072
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.002095330713584969
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:DADCAAF7512EA3D7AD1686729E54014A
                                                                                                                                                                                                                                                                                            SHA1:3EF8F0536A3D814C979CDAF337CF3CDA27C243E0
                                                                                                                                                                                                                                                                                            SHA-256:3BFC50CE4BE799EA33F338CD1BE1C30E81E1B463E34031978FB54314A255A06A
                                                                                                                                                                                                                                                                                            SHA-512:1F93B0378DC61609283045FC0612D55F9A5D63D4B5837AE28821AE105CDB4F062DE60096371ED23B32C46CCDE20155AC41DE51F65F74CC012A57A26232550C89
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:VLnk.....?............>.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Web Data

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 2, database pages 67, cookie 0x2a, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):137216
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.8810929719270382
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:3917BAB1A3CDC0E01F55BFA65FBE5C09
                                                                                                                                                                                                                                                                                            SHA1:C35CA998EF3CA0BA67A8E96C8C8769883E341064
                                                                                                                                                                                                                                                                                            SHA-256:D2968A69AAE9F6F0878AEA51A566582CF04317F7016BD4B9FC26F7AF6A7A9936
                                                                                                                                                                                                                                                                                            SHA-512:96AEB45353CFBB524BFE42E02DA011A119938884DB1C28EC8365CD6D4FFB352FE4087DD6E2E52B3E933C5628CF4C5393230518386E241B127A6AEBEE128A17F9
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ .......C...........*......................................................v............>........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\WebStorage\QuotaManager

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):40960
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.5361806991633236
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4CF7BCC60D7DD6A71C3331DC40A99DAD
                                                                                                                                                                                                                                                                                            SHA1:F6E35AB4BDF76CFA82A88CBC9C4FB7403B665E8D
                                                                                                                                                                                                                                                                                            SHA-256:F47AF4076EA7F11CCBA3D552DECBACEC8B8BE2EDF821D76D655F7176469AE880
                                                                                                                                                                                                                                                                                            SHA-512:E4686FC38DA0F4AE594C7E6F8581F4A19BB237821DA7673E1C8004D4D48D79CF39152BFC7DBA8296E34A6A6EB2CE81C6D65896B0FCACBD79B6361D8006DE1511
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:SQLite format 3......@ ..........................................................................v.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\WebStorage\QuotaManager-journal

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):12824
                                                                                                                                                                                                                                                                                            Entropy (8bit):0.27357495631640805
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:7FB756311CF11F93FD4FCFBB217DE4C3
                                                                                                                                                                                                                                                                                            SHA1:91644BED904B5FD0D1C62073EB374FC0313678A3
                                                                                                                                                                                                                                                                                            SHA-256:9537C49607E54E9688BAACBFF78C56795BAB9FD684DF9B89F8DF3AEA45BA139A
                                                                                                                                                                                                                                                                                            SHA-512:A0547DE495E8CBF675224F3B4E220B9DCD3B77D659EDEB1DEEAE1D77845FCD93AD32C1F0C594A90CDF887F52E2CB0110A450B2FC48C4FE24A918F9A0844B1B65
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:............9.[.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\a9b929a5-79b5-452c-9508-350b74eda68a.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (339)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):387
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.385785792996076
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:501D79AC0C209D6EF07A1CD5D5E9D5B2
                                                                                                                                                                                                                                                                                            SHA1:5AC75AE4DA68432292FCFDEC1C07CAA7021401F9
                                                                                                                                                                                                                                                                                            SHA-256:4F37E858D70338C227B3E4B9A55239E8428DEFE358E19CF19A34E68F83573D3C
                                                                                                                                                                                                                                                                                            SHA-512:93FAA282114ABC9431C139C124131F3BB034B44411E6E9C156DF2388807197B776A40D1264F2435B8B266A0BC611CB7E3536A0E3090669B1BB13DA295792487F
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// A1aEWiX81o4juTx5f7AKarVDiMpxWwYUf3tlycw0kik=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\aa94697b-0a85-4359-95f1-2d5fe4707c50.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.739425744361747
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5597C7CA41545808E616490F918D4759
                                                                                                                                                                                                                                                                                            SHA1:6AD4793A1A72A05A348F40AEE2528DDC0D0296FF
                                                                                                                                                                                                                                                                                            SHA-256:33932B2050723010BA5D7814CCBDDCE472F115ED5CF5B63865EB957542441069
                                                                                                                                                                                                                                                                                            SHA-512:76685ED53431C8685E96EFF2A987B64DF13D830A83E8FF0BF115AB05EE7233C733086B8BC05304355862BF3B9FF39BAC5EC997951F7E0E7D529CBB0BACFC3201
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// VyMXnhXlpyceBlX1krbvDwjYF7PAX5kGK/7hQljUZz0=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ab64764a-a987-48af-961f-9c49dce8b94b.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ac780da3-96db-428b-9b6d-f6edf3705ed5.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.729996905722814
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:0C0F72DCFB50939223C0A1586CD7C5AA
                                                                                                                                                                                                                                                                                            SHA1:7A7E5258DABF513439FCCB20DA57A5EF3103BC02
                                                                                                                                                                                                                                                                                            SHA-256:D96B80E62F110894D60AF2256B1B3B6EAA66E7BD83C1FFF822C78D3ADE8CB055
                                                                                                                                                                                                                                                                                            SHA-512:5458A613A20C4A65E517CA74D9820A192BB5CAE2C80DCB9DC102725F21A94F0BC444B204C56AB065EF7B657C0882E2AC60D5084B13E7C8235CB6F3FBB74AAC90
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// ZawPSdE9tgjkoxjr85rd1900h+YpCAELd2FakJogo4Q=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\af67c936-448d-4de8-a944-878ced52ccaa.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):311
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.432415523782879
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:38DE685570ED6512B65B07EB9DBC4F27
                                                                                                                                                                                                                                                                                            SHA1:30683140E54B1010A19EBCB005421E6BE0837E24
                                                                                                                                                                                                                                                                                            SHA-256:B53F760201D6E549EDD399ED7153A933AF67968427F5871B3D66735A2DECD3CD
                                                                                                                                                                                                                                                                                            SHA-512:F031C0261F9914FB57CCDE79AAA78E7A7AFF6235D3D3430D70A7828EC91FA30DB3A2D1D42D61D9D349B4ED6390EC5C03E1EBD4FEA2FD4B36EB56A16A40692B9C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// tcJMzU8BeEDX5KMFP2kw9hmP+K3kHHTGbdJGDsrNt1Q=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":2},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\b186f4e0-d64f-4dfb-b920-2e00fce2da8e.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (2326)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):2374
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.81572778994088
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4CA205BF51188DD7EC80CDEB121CDD31
                                                                                                                                                                                                                                                                                            SHA1:F3E8C099A03508A1F4CDC75CE784DCDBCA88FB33
                                                                                                                                                                                                                                                                                            SHA-256:896E9360ED041585371096FD24FD0836372325575B00F839439547FB4AB2D0C9
                                                                                                                                                                                                                                                                                            SHA-512:B62EB284B3A83444C9FC587E83F14D4358661D4D15D71194DD172B674267FD05AED5C4A23F18D0C20513858453A7F946368C29038DFE2E134229B8BBDAA02474
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// zyo054LFZi8GRiP5Dh+OmDKlKsOC91aOIIJObvONFQs=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"],"UserDecisions":{"address-bar-dropdown-autocompleted-domains":true,"ad

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\b38ebbc0-1af9-4a8d-ba9f-52f575b0bfa4.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.728877763803846
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:55ACECE97307B21C57EC8371FCDC8280
                                                                                                                                                                                                                                                                                            SHA1:AEED3AD018538B8CD6D66ECE780152647F70FE08
                                                                                                                                                                                                                                                                                            SHA-256:14813D93FA0B065753D1A3AE8A6E52F39AFDDC1A16A4AD5DD328D1E6BBB343AB
                                                                                                                                                                                                                                                                                            SHA-512:6751DDDC0AD1EB6154EA742698BC89DA28532DBB56E36B0BB54115937FB7A1AF2FDB95221042132D1AA8AD0C2161E5A49FA59920746BE3C3A46729352D738DAB
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// /oQL4mgu9Q0taWEX8t09mdKvVUa3rKUtlNMbfBbAIPs=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\b9e9569e-e402-410c-8869-0bffb9baf32c.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (746)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):794
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.683303324670897
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:BE016D485491FBC2315A29220B3294D1
                                                                                                                                                                                                                                                                                            SHA1:126C12B06EC194E345BAFD828ECC561AF9215058
                                                                                                                                                                                                                                                                                            SHA-256:DABC902903228A3A4129E1025E4C4B69561D528C77A472B1B5DF60990E8B1814
                                                                                                                                                                                                                                                                                            SHA-512:F32A65C3F77994CB064B6C94659D0CA8840110A849E10B2AA98C99132678E4849D2352E2197A6A78B93999A4A229700F5862089DA081ED5A368CE20BEB0F0443
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// ffC/iERf3KtyK/f9xxgMhm196hAL4khrjPnL+NI8GHg=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":2},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\bbe313bf-a81f-4306-9b99-5f52f47bd049.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):10092
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.008825629061267
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:20E2A8A0A72D776FF63F6462F27C378A
                                                                                                                                                                                                                                                                                            SHA1:56DD578040F6560D3E5223D1A3D3FDD7B384F879
                                                                                                                                                                                                                                                                                            SHA-256:98181243BEFE10624E4F9D6940E9DF8907339602616CC92558DF2651526CA29E
                                                                                                                                                                                                                                                                                            SHA-512:A2B5F2324932506E50A2547C584C97C0C72585E834296D935884C9CB5DF45F12E0EEC8C26B2DF04F32AE27ACD1439267AEBC7EEFE4C5350DCFA889DFE7AA94D6
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:{"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":128},"autofill":{"last_version_deduped":128},"bookmarks":{"trash_cleaner":{"migration_applied":true}},"browser":{"window_placement":{"height":738,"left":160,"maximized":true,"top":123,"width":960}},"chars":{"next_check":"13374686388134776"},"consent_flow":{"consent_given":false},"default_search_provider":{"synced_guid":"FF57F01A-0718-44B7-8A1F-8B15BC33A50B"},"domain_diversity":{"last_reporting_timestamp":"13374686331979103"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_opera_version":"128.0.6613.178","pinned_extensions":["igpdmclhhlcpoindmhkhillbfhdgoegm","ompjkhnkeoicimmaehlcmgmpghobbjoj","gojhcdgcpbpfigcaejpfhfegekdgiblk"]},"freedom":{"proxy_switcher":{"automatic_connection_update_applied":true,"forbidden":false,"stat_badge_state":"off"}},"gcm":{"product_category_for_subtypes":"com.operagx.windows"},"gx":{"chroma_eq

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\browser.js

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):19621
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.989203904153434
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:80553ED18189938A8E8262A55595FC2E
                                                                                                                                                                                                                                                                                            SHA1:F4331B939FBB05110D49C7D411666805D70AF883
                                                                                                                                                                                                                                                                                            SHA-256:BD1F65EE90EEC224DACE68885A31067538E5C6FD2534F243DA3C5FB95ABE0EF6
                                                                                                                                                                                                                                                                                            SHA-512:CBD3827BBCFAADBFE70FB786FD0F423D72DB0DFD5EAFAA048533B085CE42E2A5E100DC4F7F027CBDE89C45EF1CBFB35D469DE54537676AA3FBA4B5FFE7CD38CC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:*SPO*;.'...6....aw..7.r..pz..oH....{.p....*(..>D..8N5...x.R.....c6L.e..aZ.\_...<.^....^..:.)...E..x.FC/*@@.F{..5^...hU....1CNW.c+..+."......B.....R.+..?f.3Z...O..\>...{G.L...JExO...%...j./.fQ?.sf.nQ.6... 'p.M.xdY...c..L5.....H.k...j.........Q..=.{R.T7/.._d.%].hy.......U93...._z.Kk9....Y`....IV...o....V.'.}F......H....sQ/D....].!.V..`.i............l..@.9i#.......!.HNs._.\...y...Wo..I...|..E...l6.q.KL..doi...)Y.4..ij....s..T..F.K.?.n.c|K....-...FW...'.T.p.{.o.Ho...zo`......G...u..=$.+..2.U...]..$.S9....E.....4......'.j....|.....'..:o.}}...n.O4..-...L..#.....i....\o..._E..1..4.0...?.eQ....I.......7\..`...~...........%V..0.ml..j{...9pM...sbL.P.9.....[.b.e.:...=.._..l.....iy.lE.M.cYe^...ve.`..J$.....!.........C.......$iI...l......M...........k.B..qI...(H<...Q>]..X......Eo...s..+.5tx.C...d..J/e.S..3m..&.:K.,@s."............%.K...@.......C..\.Z.y....U...F..kg......O.......a^..b".S.H..x&\..k.{..M..Ef..g3DVM.9..aH..J.c.2=.Uj.'.}J.L...`._%..%{

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\c5509902-fe83-4eea-a83f-009ebc0e9d37.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (457)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):505
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.307395677412419
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:6BBC1A049D0471B0BCD9BB7CADF379CB
                                                                                                                                                                                                                                                                                            SHA1:C3112E3F34AF345256397BECB3ED7A32C99BE3F8
                                                                                                                                                                                                                                                                                            SHA-256:01D8605DF10DACF36C12DCFAB1FBC56519AB1E31B25A19914A30038C533A34D3
                                                                                                                                                                                                                                                                                            SHA-512:0D9E00A5967C89F71EAB79ED2A7EA3C17B55E0F735782A7D3A3BC787EDB16C3E2272CF0C33A57FAF263585B98D1F17894378B3111C7A54040F212FF887DB5AAD
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// FNhTGbTpDM7MvetEGZtq3tvQoTPhTp/BG9hl9BVCEVM=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"TabAverageCount":2,"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}},"consent":{"statistics_collection_enabled":true,"user_experience_metrics_reporting_enabled":true}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\c6010523-285d-4d9a-9469-d528378920c4.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1133)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1181
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.719805268152185
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C6D20A9C7B3794CA86B36D9DAE7E1D61
                                                                                                                                                                                                                                                                                            SHA1:453F193D6444116A039DE697C75F73668675A49D
                                                                                                                                                                                                                                                                                            SHA-256:24B61851EF48187661A2760042E55BAE4081449FD548F08FBDB2A2D3CF73B8BA
                                                                                                                                                                                                                                                                                            SHA-512:4C3C5E41E951D3ACA09E4249F6C2D4335E2A228CABC244568332DD480E97A5E6D1B0A450DBE7AE6D0C7551CA3FD0485D2F7B88CC80503984039D24EB492F5142
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// YjKWIJ6sVWijrYVOi+t1hEQFwn5W3mUTombFJfTU2vc=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impress

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\c77c6c0e-46cc-4a55-93fd-2a96c8b0f5bf.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (846)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):894
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.692581718464169
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8CB1982707C2823538F8C375459B2411
                                                                                                                                                                                                                                                                                            SHA1:174710431EAFE9C3342F19958B51C4DE0A09F2E0
                                                                                                                                                                                                                                                                                            SHA-256:23E9389A71B085A157CEFB38472C97B32B951EC71CAFE461F3351E03B5B4AD4A
                                                                                                                                                                                                                                                                                            SHA-512:24D9057FC47B62475B61F09BBB0BBFDA42B757023D14F032A0C966097F93A6EF908556C131C9C5AE45FE60DB17CA35871B736E20FEE18E0C16E1CBC2050B433D
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// i3ByEcpb0qi0xCDgDph8KuFBiXH2nNHKfNjyT4t8HhQ=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":1},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":2},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\continue_shopping.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3079)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):159972
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.08509752046205
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4932BC39E540EDF6F257154DD6642A87
                                                                                                                                                                                                                                                                                            SHA1:3CBCC6A06796513A605D4F4C6E662213ADE911BE
                                                                                                                                                                                                                                                                                            SHA-256:C79DB69B234C3886C4AD0B73A203ACFE15BC8E8382F4FA4E6A5E78C6CDC45607
                                                                                                                                                                                                                                                                                            SHA-512:DDBEFDE8D66DE4FCCB99E5212D4F08230B4DBE82A815BE22FD8EDCE22C9CDCBDC0BDCC4A45E9C8C0C04634F658F84A7F944CAAF4C5BAB7AD97C0CB8BBC310FA9
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// ACBmtoCIjfrw1GiE40PTqisc+nBGUkeyOySvFKxkt2F/Sb+UazUpMxaetnu1AgYREo6WpCf6WtunjeBaSzbaTKIxy1WJP2EPnkhlfGvJGc4a+7YxnqSIsd1z712rcHBiBknEzcNNPgjhnCTtICto8ED85wYdD8VrvkHCYfy6Z0tyErEJqQMfC5HwVL/Kaa8BpUvV/C4prLWL6b0jacaKPynS99p+eIYn0o2Aa4W7xG+Fpn/E3PxgWnqz3BjHopQ+bu84K7eoiL6QcrvJzmM9ZMI+Fxx1/55vy0o4NVJ1eC85tYXgaDAwfYIk6aSdwSXWxa+plelbonkwj3aiatFLSQ==.{. "version": 14,. "partners": [. {. "partner_id": "aboutyou_at",. "partner_domain": "aboutyou.at",. "product_url_pattern": "\/p\/.*",. "product_history_pattern": "\"aboutyou.at/p/\"",. "partner_icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAAAclBMVEUAAAD////4+PgYGBikpKQmJiYLCwvi4uLb29tLS0v09PTp6emCgoJra2tcXFxJSUnr6+vJycmKioo6OjojIyP8/PxfX1/6+vrMzMyamprf39/S0tLR0dG9vb28vLxDQ0MfHx8aGhrd3d2GhoZ3d3dFRUWvj4E8AAABVklEQVRIx+1VV5bDIAy0wcbg3kt62b3/FTeUZ+EW7Yt/M5/SSIyEEM4Xn4L5lRCVz/7Hpq13jEJCwujotRSl1yVv3BENL+v3/OThzsCTd2o84i5AvE1dt/NIyoMgH4PPt438F8Mu4syn1M/iwsRc1s/wtLdP2dje1JTkrdbbqfSDne0a6IBup

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\custom_partner_content.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):242304
                                                                                                                                                                                                                                                                                            Entropy (8bit):6.028776242997077
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                                                                                                            SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                                                                                                            SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                                                                                                            SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_users": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ef7806db-f4a1-46c9-b3ff-320250495b13.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (3222)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):3270
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.945055007888767
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:64AD185184F32DDE9E19444D6CB2ABF5
                                                                                                                                                                                                                                                                                            SHA1:4956543AD24C14146B99BD84C2A0B83F4DD83BF7
                                                                                                                                                                                                                                                                                            SHA-256:8BBBDA63B00FB039C967B0B306B0A22ED36BF9851E6763E245230CF56197E250
                                                                                                                                                                                                                                                                                            SHA-512:7E558CE9BB3B6A90C36D5188399C05D61CFF3C6CFA21D3AD2F8F4D6F896A152F9F4EE5FA8BFFBFA3157924BBA1C2606F0F7BB4E5880520E439BA5F68FB648652
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// SOASfWtu2oHAEStFlXc8F9DHD8uNtgApZgSU+WA+ukM=.{"ABTests":{"Tests":{"DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"BlacklistedExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","si

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\fefa5d00-5928-4907-a922-c4a574872260.tmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1401
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.729374919368428
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:06202955CF2868778E712E0DC458FF94
                                                                                                                                                                                                                                                                                            SHA1:C9F6F4412D6E859297133CB98282CD020CF6AA3F
                                                                                                                                                                                                                                                                                            SHA-256:1752BDCC750ED95A9BB69BEF1CF5CA56C34BE739742F6A9B6029E59168A67E71
                                                                                                                                                                                                                                                                                            SHA-512:1A594FF7DCB28F2F6BDC5BEA0459E5B28FF8A394FA57CA45F2481FBC6D03FA97B2461F686A147C3ECA460D974F08C4CA282498295C5B54BB972FE4EE54753489
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// b4wIKw1UldowB4UoukFQlJIQ/8RjwlUU/Ef1AdWGqW8=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://gx.games/pl/games/3c4950/decks-of-dexterity/":{"gNahodaVUHqRh8Y09sQgTS0i5Rxbv3tw2ZXEwF89smg=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\partner_speeddials.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:JSON data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):6655
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.530736207968022
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4AB41518A7E953AC7F020399A5251FFD
                                                                                                                                                                                                                                                                                            SHA1:A7251B85857738ADEF019D12F7412837D86DE67B
                                                                                                                                                                                                                                                                                            SHA-256:68DD305799F59069DF9BDCE7677C6A3C5574D4C2DB9E609C8592881E7CB16EF7
                                                                                                                                                                                                                                                                                            SHA-512:BEC5B41CB170D3AD7D33E4F238D50EE47FE44A79FA968408295F7EE988A60BE7BE8F7704AC09C42BA0E6F0663A2188351B589F6EAB9D4D82124480F21E892D2A
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:[{"favicon_url":"https://sd-images.operacdn.com/api/v1/images/46b911f451044a30c1aa38f062e1a4939605f09b.png","impression_url":"","name":"Twitch","partner_id":"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=","ping_url":"https://speeddials.opera.com/api/v1/clicks/UThSMEtvZDZjOS9IK2kxdFJPeU1lSm04a3lUZVp2WXlDaFVyWnZBamxpWT0=","position":1,"real_url":"https://www.twitch.tv/","replaceable":false,"revision":"20190409","thumbnail_url":"https://sd-images.operacdn.com/api/v1/images/81b328383b9ac7aaff14a25cb73e54f89fd6abfd.png","url":"https://www.twitch.tv/"},{"favicon_url":"https://sd-images.operacdn.com/api/v1/images/c9b683a381b2136f24ae0d6f25b65ec65e333c60.png","impression_url":"","name":"Hero Wars","partner_id":"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=","ping_url":"https://speeddials.opera.com/api/v1/clicks/eVJNUGtXODJSL2tiWWFRUzlRaDQvYUh1ZDBjc040WHlyWlJ0RVdMZGhvOD0=","position":2,"real_url":"https://cafxq.com/g/p1w1p7evoza47a83735c56878d5ce4/?subid1=gx-us-admitad-herowars-sd-october-flatfee

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):287
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.238181086510404
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:90A1BE0881A9FB61A15A125B2C05B8D2
                                                                                                                                                                                                                                                                                            SHA1:918AD27333D01B1FB83D41D50A4E4CB169065623
                                                                                                                                                                                                                                                                                            SHA-256:ABF09870099E9B11564A2348C4BFCAFC3EBA18964981F9562CC953AA0B0DC205
                                                                                                                                                                                                                                                                                            SHA-512:55BF9D0E64F6F218AC3122094E6C367CCCDCE698B9F9C0DE51B8318E2DBD56146376B02B403C797CDFBCA0FF22FBFA9F3469B19EC88F20EBFB313DE916976A76
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:52.555 11d4 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db since it was missing..2024/10/29-10:38:52.836 11d4 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\000003.log

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):184
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.7144771362641436
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:A1DAECAFC28B9D1DB579A99B7A43D746
                                                                                                                                                                                                                                                                                            SHA1:F2E1D1471DD4EBEAEBD538934A74F0B114F56545
                                                                                                                                                                                                                                                                                            SHA-256:568C9C190D35B11D5E298225414AFE46C49882044E5A24E205F08B9CED46B9FE
                                                                                                                                                                                                                                                                                            SHA-512:70B8E593C246CEBFC0309D84CEB51D8962BC2CBAF92BA05F193A38FAD64185695D83B448E94EFB2396C725296B716C3C4ADD5E5CC3EE740CFEADD4546D0ACD08
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.h.6.................__global... .t...................__global... ...w.................44_..........................21_.........................44_.....vuNX.................21_.....

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):16
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                                                            SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                                                            SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                                                            SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\LOG

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):305
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.175438238058381
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:CE10D8F34E593B5883FEE7AC5CDDFD83
                                                                                                                                                                                                                                                                                            SHA1:448A45BB4538AC22DBDBFA0768B196998AC5E537
                                                                                                                                                                                                                                                                                            SHA-256:4A63DC5A0475D91F6C2CE52F6A2CAF790A50B918133D4E1D1E59F2822E32A221
                                                                                                                                                                                                                                                                                            SHA-512:BF83ADBCFB917CE900464D1DF5F797AD660CB10B6F57A0D930E8B1F983EA17327C1F342ADE366FF4AC8CB7D41B4A3627B7918FCD4C4141E5B25E7ABD2EECCF3E
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:2024/10/29-10:38:52.289 11d4 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata since it was missing..2024/10/29-10:38:52.494 11d4 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):41
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                                                            SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                                                            SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                                                            SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\siteprefs.json

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):18005
                                                                                                                                                                                                                                                                                            Entropy (8bit):7.988959164278047
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:D7F3EF4F92FCA91C430BCF940038CA05
                                                                                                                                                                                                                                                                                            SHA1:DC7AE93D360E0940DA2D0D810449B3617F8C80A5
                                                                                                                                                                                                                                                                                            SHA-256:9071F1778D57009E2AD23AC7A475FCE51EC6829B4FDBD7A61BD4321146D08EDD
                                                                                                                                                                                                                                                                                            SHA-512:E482A2050C38AAD5F2CC86F32AFED13B607AB8A3B6D70E614113C882C1AC68920035B3169C7AED9731A0BB0E48F85D03E52654ACF4AF0D8A298069EEFFADCEE5
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:*SPO*zE....:9S....%..Z.6...b0..Z.W....>..A{..g..s..-.....m...zU...'.$Nu....G.(9p.."...O..D.....Fw.#..QR.K3Z.=XRse....U....#...7Tv...a..H....x......G..4<O^*BV...4.8....w...C....X..BD8..$o.?.g.P..p9...'3%GS~..C..7..%...~..(e.....U...>=%(...MgR...I.R.U.`.l7...,.f...V......_.|.<?...h.........[..OFkT..N.6.a.....S...(.A..`..V.O.HMV..:KTD.DSru..'.7.,....3..X|.>M.IP...s.j)F.....a.4S.......K..Q.....el"b.......pz...c.T.\.y....e..YK6.sT(`.qE....I.....m...Cp.9.rW(.I8..H....H........(...C....W._..x..U,).j...>.............(.....>u..I..?........<...)C..."..S-]..Y...'...%.....y....a.bI.|..zb.Kk2A.2..)...@...X.Z..7........P.Cb..rt..n...]..h.....E.]..B.....z..z.8.I..l|.p......!..<...).'.n|...AR.D...C...B.'*O.c.d....7P.K%y:s....O.@G.o..9...W.....'....c..F[.\.a.j(/..}.......p.Qf(...Xp.}..?.\..:.Z/3.7........@.8.....,".7.J.|<x..!.B.&....Md.Y..a..p..Q..y...ul..7...C.H;M..G.>K#..v......(.[.B.<Z....`.6Y.I..w.&..!...Y........D.r.S..aM.'}Z..%..M.=.'l.g......#.....W.^..

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617 (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5e73.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5e82.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5ee0.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5ef0.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5eff.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5f0f.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5f1e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5f2e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.0.748893617~RF3d5f3e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):327
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.314414976452194
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:C063ADE913AD507B839C7062C4E0DB08
                                                                                                                                                                                                                                                                                            SHA1:C5E76BFE3F71ACF03886E6EE8DE03DF7F6FD4C1C
                                                                                                                                                                                                                                                                                            SHA-256:A19B41234A534E4396C68269F01D59076BEEC768F862B395436B18657E8FA2E8
                                                                                                                                                                                                                                                                                            SHA-512:27D9A25580744155A2F21C2A61DF9FDF3EC080CA7B0B0767AFE91F5E97D311BBB5856A2B8F2FB2B29E5D9A7D27F43D529AA2142DDD72519899F747F3E6443938
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// rTpkF/hQ52994esntsxnJIUx6CZ6wp89bo8p0/uDov0=.{"InstallType":"Normal","OSPMessageUUID":"e4f150df-1a6b-48d8-b9a9-4049e42756c1","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726 (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d5f6d.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6103.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d676b.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6b53.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6e80.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6e9f.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6eaf.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6eed.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6f3b.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6fc8.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d6fe7.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7016.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7035.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7045.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7064.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7769.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7788.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7df1.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7e10.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7e4f.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7e6e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7e7e.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7e9d.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7edb.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d7f39.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp508.1.2065713726~RF3d8072.TMP (copy)

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):171
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.557125855132864
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:EE8687BC36CC7BCC4EB3D2CC8674448E
                                                                                                                                                                                                                                                                                            SHA1:31062209ED3FF488AD5342A33CD33AFFEDD9102C
                                                                                                                                                                                                                                                                                            SHA-256:31FC28F55268CA7493131E7ACFC53A203380F5FC7ED680EA1C175945C391B19F
                                                                                                                                                                                                                                                                                            SHA-512:68A75A92A57F8352DA3C20FDD1E6CD19F6E0FAA088C65B0C63616B546C2406B2DE6A902F7907A4BD36AE7B2011C59E07192982E2A1A6428851C40BB9CBC9CCEA
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:// 4UJ9iCJmpYio1RtFAWdfGN2+2k7c7Hutm5KYNCErnl4=.{"OSPMessageUUID":"1c3ad07f-3724-46d5-aafd-489b8aba54b4","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                                                                                                            C:\Users\user\Desktop\Opera GX Browser .lnk

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Oct 29 13:38:32 2024, mtime=Tue Oct 29 13:38:32 2024, atime=Wed Oct 23 13:41:31 2024, length=1493400, window=hide
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):1432
                                                                                                                                                                                                                                                                                            Entropy (8bit):4.904966760623039
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:21842DDC375F196CDEB45E3CD2FD4585
                                                                                                                                                                                                                                                                                            SHA1:6BBD6C9234606334C08E1D0082C389330038B353
                                                                                                                                                                                                                                                                                            SHA-256:1DE4A136A30B9F7A9C77D3A769BC323D4E79C246245951799FF92E60C5CA392A
                                                                                                                                                                                                                                                                                            SHA-512:B927F6D90109291B295FC40F17913EE2B628F314EAEB8F3239AC31CB2B06EAFFF7E8DB144C211591ADED23118F23F7340640872A7000A1E2A6209F7FDFBBC18C
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:L..................F.... .....Q:.*....Q:.*......Y%............................:..DG..Yr?.D..U..k0.&...&.......$..S.....s..*....p:.*......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2]Y.t...........................^.A.p.p.D.a.t.a...B.P.1.....]Y.t..Local.<......EW<2]Y.t....[......................ac.L.o.c.a.l.....Z.1.....]Y.t..Programs..B......]Y.t]Y.t....`......................tv.P.r.o.g.r.a.m.s.....Z.1.....]Y.t..OPERAG~1..B......]Y.t]Y.t....q......................\..O.p.e.r.a. .G.X.....\.2.....WY0u .opera.exe.D......]Y.t]Y.t.....A.....................J.o.p.e.r.a...e.x.e.......j...............-.......i.............F......C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe..,.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.o.p.e.r.a...e.x.e.1.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........|....I.J.H..K..:...`.......X.......580913...........hT..CrF

                                                                                                                                                                                                                                                                                            \Device\Mailslot\opera_installer\C:\Users\user\AppData\Local\Programs\Opera GX

                                                                                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                                                                                            Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                                                                                            Size (bytes):5008
                                                                                                                                                                                                                                                                                            Entropy (8bit):3.9557921126337647
                                                                                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                                                                                            SSDEEP:
                                                                                                                                                                                                                                                                                            MD5:4274D3A0F00940EA66C48780D3F9AC52
                                                                                                                                                                                                                                                                                            SHA1:E3798635603721A4E162C3931F69899C7C5E9107
                                                                                                                                                                                                                                                                                            SHA-256:92F154584DF37349936E9AC5D8427F1B185E2C55EA5368C2D0F544AFA5299C3F
                                                                                                                                                                                                                                                                                            SHA-512:A3AED7EB569A1288DA577439C49D37A5ACDB37DC32A705B67C156CC3953C917599727A6C79F17B0B1C93F759A3E78C06F15E1CD779C9CAAA84955A8F7E159BDC
                                                                                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                                                                                            Reputation:unknown
                                                                                                                                                                                                                                                                                            Preview:........:Installer message:..... .......:Installer message:......... .......:Installer message:.....(...8.......:Installer message:.........verify_package_contents.H.......:Installer message:.........verify_package_contents.................P.......:Installer message:...../...copy_file:resources/custom_partner_content.json.`.......:Installer message:...../...copy_file:resources/custom_partner_content.json.................0.......:Installer message:.........delete_file_step@.......:Installer message:.........delete_file_step................0.......:Installer message:.........delete_file_step@.......:Installer message:.........delete_file_step................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................

                                                                                                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                                            Entropy (8bit):5.992205981551635
                                                                                                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                                                                                                            • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                                                                            • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                                                            File name:SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe
                                                                                                                                                                                                                                                                                            File size:330'048 bytes
                                                                                                                                                                                                                                                                                            MD5:2a3b7cf9d36c8e04db084638fd066ad5
                                                                                                                                                                                                                                                                                            SHA1:6e25322226e38e6e921cfacb631556cf66dd5b06
                                                                                                                                                                                                                                                                                            SHA256:1e5bc37886c1983546bcd39efce0d4bd05b88f57da45686b48a375676c43bc4e
                                                                                                                                                                                                                                                                                            SHA512:c361031e02c47c9d1aa3a9ef4e8ce5daac42b617ae687af83ee1ca16099ae6db36bd5bb960f0d21fd567d153debea291f81c321c07bc9044a8d5824786d6acda
                                                                                                                                                                                                                                                                                            SSDEEP:3072:+SKgKC+taT9r+76b1awXGVgXexnVkKwtHQJ1Kmo1SxKsF8wUlDB3evCSPjF:zfT9r+k1tXGVSYc812woGB
                                                                                                                                                                                                                                                                                            TLSH:8764A14362DC3CE6D0768274AB7743C5E72EEC4507A1D68F02E042A6DE3E693792A7D1
                                                                                                                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........U.xg..xg..xg...d..xg...b.cxg...c..xg...d..xg...c..xg...b..xg...f..xg..xf.Lxg...n..xg......xg..x...xg...e..xg.Rich.xg........

                                                                                                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                                                                                                            Icon Hash:17170f6d2b2d2d13

                                                                                                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Entrypoint:0x140007740
                                                                                                                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                                                                                                                            Digitally signed:true
                                                                                                                                                                                                                                                                                            Imagebase:0x140000000
                                                                                                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                                                            Time Stamp:0x66F694EA [Fri Sep 27 11:20:10 2024 UTC]
                                                                                                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                                                                                                            OS Version Major:6
                                                                                                                                                                                                                                                                                            OS Version Minor:0
                                                                                                                                                                                                                                                                                            File Version Major:6
                                                                                                                                                                                                                                                                                            File Version Minor:0
                                                                                                                                                                                                                                                                                            Subsystem Version Major:6
                                                                                                                                                                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                                                                                                                                                                            Import Hash:5c999c610720e51b6a0a83e13dbd0adc

                                                                                                                                                                                                                                                                                            Authenticode Signature

                                                                                                                                                                                                                                                                                            Signature Valid:true
                                                                                                                                                                                                                                                                                            Signature Issuer:CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
                                                                                                                                                                                                                                                                                            Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                                                                                            Error Number:0
                                                                                                                                                                                                                                                                                            Not Before, Not After
                                                                                                                                                                                                                                                                                            • 22/09/2023 09:18:31 03/12/2024 08:05:00
                                                                                                                                                                                                                                                                                            Subject Chain
                                                                                                                                                                                                                                                                                            • CN=OOO NBZ, O=OOO NBZ, L=Saint Petersburg, S=Saint Petersburg, C=RU
                                                                                                                                                                                                                                                                                            Version:3
                                                                                                                                                                                                                                                                                            Thumbprint MD5:644D93EB2A924788DC9F5A261B15A128
                                                                                                                                                                                                                                                                                            Thumbprint SHA-1:8FF463CEC205068C449EBE08BC5EADB1E8BEF78D
                                                                                                                                                                                                                                                                                            Thumbprint SHA-256:A0C6E99ECA1E36FBCEE4434A33A8862414BE13C68E7464DAE8CB84914EEF564E
                                                                                                                                                                                                                                                                                            Serial:01181B5DC7EF7467C6035C60

                                                                                                                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                                                                                            call 00007F998888F6C0h
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                                                                                            jmp 00007F998888EBDFh
                                                                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            sub esp, 28h
                                                                                                                                                                                                                                                                                            dec ebp
                                                                                                                                                                                                                                                                                            mov eax, dword ptr [ecx+38h]
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov ecx, edx
                                                                                                                                                                                                                                                                                            dec ecx
                                                                                                                                                                                                                                                                                            mov edx, ecx
                                                                                                                                                                                                                                                                                            call 00007F998888ED72h
                                                                                                                                                                                                                                                                                            mov eax, 00000001h
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            add esp, 28h
                                                                                                                                                                                                                                                                                            ret
                                                                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                                                                            inc eax
                                                                                                                                                                                                                                                                                            push ebx
                                                                                                                                                                                                                                                                                            inc ebp
                                                                                                                                                                                                                                                                                            mov ebx, dword ptr [eax]
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov ebx, edx
                                                                                                                                                                                                                                                                                            inc ecx
                                                                                                                                                                                                                                                                                            and ebx, FFFFFFF8h
                                                                                                                                                                                                                                                                                            dec esp
                                                                                                                                                                                                                                                                                            mov ecx, ecx
                                                                                                                                                                                                                                                                                            inc ecx
                                                                                                                                                                                                                                                                                            test byte ptr [eax], 00000004h
                                                                                                                                                                                                                                                                                            dec esp
                                                                                                                                                                                                                                                                                            mov edx, ecx
                                                                                                                                                                                                                                                                                            je 00007F998888ED75h
                                                                                                                                                                                                                                                                                            inc ecx
                                                                                                                                                                                                                                                                                            mov eax, dword ptr [eax+08h]
                                                                                                                                                                                                                                                                                            dec ebp
                                                                                                                                                                                                                                                                                            arpl word ptr [eax+04h], dx
                                                                                                                                                                                                                                                                                            neg eax
                                                                                                                                                                                                                                                                                            dec esp
                                                                                                                                                                                                                                                                                            add edx, ecx
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            arpl ax, cx
                                                                                                                                                                                                                                                                                            dec esp
                                                                                                                                                                                                                                                                                            and edx, ecx
                                                                                                                                                                                                                                                                                            dec ecx
                                                                                                                                                                                                                                                                                            arpl bx, ax
                                                                                                                                                                                                                                                                                            dec edx
                                                                                                                                                                                                                                                                                            mov edx, dword ptr [eax+edx]
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov eax, dword ptr [ebx+10h]
                                                                                                                                                                                                                                                                                            mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov eax, dword ptr [ebx+08h]
                                                                                                                                                                                                                                                                                            test byte ptr [ecx+eax+03h], 0000000Fh
                                                                                                                                                                                                                                                                                            je 00007F998888ED6Dh
                                                                                                                                                                                                                                                                                            movzx eax, byte ptr [ecx+eax+03h]
                                                                                                                                                                                                                                                                                            and eax, FFFFFFF0h
                                                                                                                                                                                                                                                                                            dec esp
                                                                                                                                                                                                                                                                                            add ecx, eax
                                                                                                                                                                                                                                                                                            dec esp
                                                                                                                                                                                                                                                                                            xor ecx, edx
                                                                                                                                                                                                                                                                                            dec ecx
                                                                                                                                                                                                                                                                                            mov ecx, ecx
                                                                                                                                                                                                                                                                                            pop ebx
                                                                                                                                                                                                                                                                                            jmp 00007F998888E7A6h
                                                                                                                                                                                                                                                                                            int3
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov eax, esp
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov dword ptr [eax+08h], ebx
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov dword ptr [eax+10h], ebp
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov dword ptr [eax+18h], esi
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov dword ptr [eax+20h], edi
                                                                                                                                                                                                                                                                                            inc ecx
                                                                                                                                                                                                                                                                                            push esi
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            sub esp, 20h
                                                                                                                                                                                                                                                                                            dec ecx
                                                                                                                                                                                                                                                                                            mov ebx, dword ptr [ecx+38h]
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov esi, edx
                                                                                                                                                                                                                                                                                            dec ebp
                                                                                                                                                                                                                                                                                            mov esi, eax
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov ebp, ecx
                                                                                                                                                                                                                                                                                            dec ecx
                                                                                                                                                                                                                                                                                            mov edx, ecx
                                                                                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                                                                                            mov ecx, esi
                                                                                                                                                                                                                                                                                            dec ecx
                                                                                                                                                                                                                                                                                            mov edi, ecx
                                                                                                                                                                                                                                                                                            dec esp
                                                                                                                                                                                                                                                                                            lea eax, dword ptr [ebx+04h]
                                                                                                                                                                                                                                                                                            call 00007F998888ECD1h

                                                                                                                                                                                                                                                                                            Data Directories

                                                                                                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3182c0x78.rdata
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x390000x17328.rsrc
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x360000x21b4.pdata
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x4c6000x4340
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x510000x944.reloc
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x2d9500x70.rdata
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2d8100x140.rdata
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x230000x3b0.rdata
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                                                            Sections

                                                                                                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                                                            .text0x10000x216200x218006e88957f20371dd86c91c2702040f712False0.5551247667910447data6.4439995257162686IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                            .rdata0x230000xf48c0xf60075421da2e309324b543b184822697d91False0.39697662601626016data4.664144247404109IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                            .data0x330000x2d1c0x1400ed74d032ee7a7dbea3015bfb2cae18dcFalse0.165234375DOS executable (block device driver)2.703146690010773IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                                            .pdata0x360000x21b40x2200b1cd0954b97a4c5a80706e30795739f9False0.47736672794117646data5.2954647980763685IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                            .rsrc0x390000x173280x17400cf0335e0c167d3ffe128896a56ad858dFalse0.12026419690860216data4.0435953038232295IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                                            .reloc0x510000x9440xa00646af04dc6e9b1b4a37793c82beb1d70False0.486328125data5.293087605895363IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                                                            Resources

                                                                                                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                                                            RT_ICON0x395700x115aPNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States0.33340837460603334
                                                                                                                                                                                                                                                                                            RT_ICON0x3a6d00xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.09408315565031983
                                                                                                                                                                                                                                                                                            RT_ICON0x3b5780x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.11507220216606498
                                                                                                                                                                                                                                                                                            RT_ICON0x3be200x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.12427745664739884
                                                                                                                                                                                                                                                                                            RT_ICON0x3c3880x90bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.791792656587473
                                                                                                                                                                                                                                                                                            RT_ICON0x3cc980x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.03235710911667454
                                                                                                                                                                                                                                                                                            RT_ICON0x40ec00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.04595435684647303
                                                                                                                                                                                                                                                                                            RT_ICON0x434680x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.075046904315197
                                                                                                                                                                                                                                                                                            RT_ICON0x445100x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.15070921985815602
                                                                                                                                                                                                                                                                                            RT_ICON0x44a000x115aPNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States0.33340837460603334
                                                                                                                                                                                                                                                                                            RT_ICON0x45b600xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.09408315565031983
                                                                                                                                                                                                                                                                                            RT_ICON0x46a080x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.11507220216606498
                                                                                                                                                                                                                                                                                            RT_ICON0x472b00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.12427745664739884
                                                                                                                                                                                                                                                                                            RT_ICON0x478180x90bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.791792656587473
                                                                                                                                                                                                                                                                                            RT_ICON0x481280x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.03235710911667454
                                                                                                                                                                                                                                                                                            RT_ICON0x4c3500x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.04595435684647303
                                                                                                                                                                                                                                                                                            RT_ICON0x4e8f80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.075046904315197
                                                                                                                                                                                                                                                                                            RT_ICON0x4f9a00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.15070921985815602
                                                                                                                                                                                                                                                                                            RT_MENU0x4fe900x4adataEnglishUnited States0.8648648648648649
                                                                                                                                                                                                                                                                                            RT_DIALOG0x4fef00x154dataEnglishUnited States0.5588235294117647
                                                                                                                                                                                                                                                                                            RT_STRING0x500480x60dataEnglishUnited States0.6666666666666666
                                                                                                                                                                                                                                                                                            RT_ACCELERATOR0x4fee00x10dataEnglishUnited States1.25
                                                                                                                                                                                                                                                                                            RT_GROUP_ICON0x449780x84dataEnglishUnited States0.6590909090909091
                                                                                                                                                                                                                                                                                            RT_GROUP_ICON0x4fe080x84dataEnglishUnited States0.6515151515151515
                                                                                                                                                                                                                                                                                            RT_MANIFEST0x500a80x27eXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5517241379310345

                                                                                                                                                                                                                                                                                            Imports

                                                                                                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                                                                                                            KERNEL32.dllWaitForSingleObject, CreateThread, SetEndOfFile, WriteConsoleW, HeapSize, CreateFileW, ReadConsoleW, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, HeapReAlloc, ReadFile, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, FlsFree, FlsSetValue, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, RaiseException, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, WriteFile, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, HeapFree, CloseHandle, GetFileSizeEx, SetFilePointerEx, GetFileType, HeapAlloc, FlsAlloc, FlsGetValue, RtlUnwind
                                                                                                                                                                                                                                                                                            USER32.dllEndPaint, BeginPaint, UpdateWindow, GetMessageW, DefWindowProcW, MonitorFromWindow, CreateWindowExW, SendMessageW, RegisterClassExW, LoadAcceleratorsW, LoadStringW, ShowWindow, DispatchMessageW, SetTimer, GetMonitorInfoW, TranslateAcceleratorW, TranslateMessage, LoadIconW, LoadCursorW, SetWindowLongW, KillTimer, PostQuitMessage
                                                                                                                                                                                                                                                                                            SHELL32.dllSHCreateDirectoryExW, CommandLineToArgvW, ShellExecuteW, SHGetFolderPathW
                                                                                                                                                                                                                                                                                            ole32.dllCoInitializeEx
                                                                                                                                                                                                                                                                                            urlmon.dllURLDownloadToFileW

                                                                                                                                                                                                                                                                                            Possible Origin

                                                                                                                                                                                                                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                                                            EnglishUnited States

                                                                                                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                                                                                                            ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                                                                                                            Start time:10:37:00
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff73cc40000
                                                                                                                                                                                                                                                                                            File size:330'048 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:2A3B7CF9D36C8E04DB084638FD066AD5
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:3
                                                                                                                                                                                                                                                                                            Start time:10:37:08
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe" --silent --allusers=0
                                                                                                                                                                                                                                                                                            Imagebase:0xd00000
                                                                                                                                                                                                                                                                                            File size:3'313'792 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:8A3BD58257B48475AE9B793F522E5759
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:4
                                                                                                                                                                                                                                                                                            Start time:10:37:10
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --silent --allusers=0 --server-tracking-blob=YzNjYzBkNzBjNDk4NTlkM2U3YTIzOTI2N2M2ZGIyMjU0OGQ2OWMxY2Y5YjZkMTY4MGI3OTJjMTc3ZDI3MGZkMjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInRpbWVzdGFtcCI6IjE3MzAyMTI2MjMuNTk2OCIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDcuMDsgV2luZG93cyBOVCA2LjI7IFdpbjY0OyB4NjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoib2d4IiwiY29udGVudCI6Im9neGlfMzQ0MjAiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6Ik9GVCJ9LCJ1dWlkIjoiOWVkN2VlMTktY2FmYi00MTZkLTliNzQtMWI1ZGNkMDQwNWZiIn0=
                                                                                                                                                                                                                                                                                            Imagebase:0x60000
                                                                                                                                                                                                                                                                                            File size:6'820'248 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:A910474AAD1EEA96921D359E1763D2FD
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:5
                                                                                                                                                                                                                                                                                            Start time:10:37:11
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x32c,0x330,0x334,0x318,0x338,0x6c998c5c,0x6c998c68,0x6c998c74
                                                                                                                                                                                                                                                                                            Imagebase:0x60000
                                                                                                                                                                                                                                                                                            File size:6'820'248 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:A910474AAD1EEA96921D359E1763D2FD
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:6
                                                                                                                                                                                                                                                                                            Start time:10:37:11
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                                                                                                                                                                                                                                                            Imagebase:0x6f0000
                                                                                                                                                                                                                                                                                            File size:6'820'248 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:A910474AAD1EEA96921D359E1763D2FD
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:7
                                                                                                                                                                                                                                                                                            Start time:10:37:12
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=3928 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241029103712" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C06000000000000
                                                                                                                                                                                                                                                                                            Imagebase:0x60000
                                                                                                                                                                                                                                                                                            File size:6'820'248 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:A910474AAD1EEA96921D359E1763D2FD
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:8
                                                                                                                                                                                                                                                                                            Start time:10:37:12
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:C:\Users\user\AppData\Local\Temp\7zSC91E97EB\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x33c,0x340,0x344,0x308,0x318,0x6baf8c5c,0x6baf8c68,0x6baf8c74
                                                                                                                                                                                                                                                                                            Imagebase:0x60000
                                                                                                                                                                                                                                                                                            File size:6'820'248 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:A910474AAD1EEA96921D359E1763D2FD
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:12
                                                                                                                                                                                                                                                                                            Start time:10:37:52
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                                                                                                            File size:1'499'104 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:E9A2209B61F4BE34F25069A6E54AFFEA
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:13
                                                                                                                                                                                                                                                                                            Start time:10:37:53
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --version
                                                                                                                                                                                                                                                                                            Imagebase:0x1f0000
                                                                                                                                                                                                                                                                                            File size:1'853'592 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:4C8FBED0044DA34AD25F781C3D117A66
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:14
                                                                                                                                                                                                                                                                                            Start time:10:37:53
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x3a4f48,0x3a4f58,0x3a4f64
                                                                                                                                                                                                                                                                                            Imagebase:0x1f0000
                                                                                                                                                                                                                                                                                            File size:1'853'592 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:4C8FBED0044DA34AD25F781C3D117A66
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:moderate
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:15
                                                                                                                                                                                                                                                                                            Start time:10:38:31
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --backend --initial-pid=3928 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410291037121" --session-guid=50fea559-f106-47bc-9a77-4335435774ab --server-tracking-blob=NTA0MmFkMjJhOTRhYTI0MTZkOWU1NmNhMTJiZWQ1NWVhNTUyZjhhZGMwMDUyYmM1ZGQzZjI4NDNjMzQwNmFjNTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yLz91dG1fc291cmNlPU9GVCZ1dG1fbWVkaXVtPXBiJnV0bV9jYW1wYWlnbj1vZ3gmdXRtX2NvbnRlbnQ9b2d4aV8zNDQyMCIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTczMDIxMjYyMy41OTY4IiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV2luNjQ7IHg2NDsgVHJpZGVudC83LjA7IC5ORVQ0LjBDOyAuTkVUNC4wRTsgLk5FVCBDTFIgMi4wLjUwNzI3OyAuTkVUIENMUiAzLjAuMzA3Mjk7IC5ORVQgQ0xSIDMuNS4zMDcyOSkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJvZ3giLCJjb250ZW50Ijoib2d4aV8zNDQyMCIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiT0ZUIn0sInV1aWQiOiI5ZWQ3ZWUxOS1jYWZiLTQxNmQtOWI3NC0xYjVkY2QwNDA1ZmIifQ== --silent --desktopshortcut=1 --install-subfolder=114.0.5282.123
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff6e57b0000
                                                                                                                                                                                                                                                                                            File size:7'977'368 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:E169C65773E40654455624EADD122953
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:16
                                                                                                                                                                                                                                                                                            Start time:10:38:31
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x250,0x254,0x27c,0x258,0x280,0x7ffd94469e20,0x7ffd94469e2c,0x7ffd94469e38
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff6e57b0000
                                                                                                                                                                                                                                                                                            File size:7'977'368 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:E169C65773E40654455624EADD122953
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:18
                                                                                                                                                                                                                                                                                            Start time:10:38:33
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff609140000
                                                                                                                                                                                                                                                                                            File size:5'141'208 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:19
                                                                                                                                                                                                                                                                                            Start time:10:38:37
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Reputation:high
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:21
                                                                                                                                                                                                                                                                                            Start time:10:38:37
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:22
                                                                                                                                                                                                                                                                                            Start time:10:38:37
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:23
                                                                                                                                                                                                                                                                                            Start time:10:38:37
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:24
                                                                                                                                                                                                                                                                                            Start time:10:38:37
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:25
                                                                                                                                                                                                                                                                                            Start time:10:38:37
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:26
                                                                                                                                                                                                                                                                                            Start time:10:38:38
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:27
                                                                                                                                                                                                                                                                                            Start time:10:38:38
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:28
                                                                                                                                                                                                                                                                                            Start time:10:38:38
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff627e70000
                                                                                                                                                                                                                                                                                            File size:1'493'400 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:94851594215654A9EFCE5F3C3830A9C1
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:29
                                                                                                                                                                                                                                                                                            Start time:10:38:38
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --bypasslauncher 0
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff79cda0000
                                                                                                                                                                                                                                                                                            File size:5'819'288 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:84762F0101AE1F06BCB76F70A0308FD0
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:30
                                                                                                                                                                                                                                                                                            Start time:10:38:38
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:31
                                                                                                                                                                                                                                                                                            Start time:10:38:40
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:32
                                                                                                                                                                                                                                                                                            Start time:10:38:41
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:33
                                                                                                                                                                                                                                                                                            Start time:10:38:41
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:34
                                                                                                                                                                                                                                                                                            Start time:10:38:41
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:35
                                                                                                                                                                                                                                                                                            Start time:10:38:41
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.123\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffd92de1388,0x7ffd92de1398,0x7ffd92de13a8
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff728c20000
                                                                                                                                                                                                                                                                                            File size:2'017'176 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:F2FDAF82F5AA813C34BF1E4065AF7CFA
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                                                                                                            • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:36
                                                                                                                                                                                                                                                                                            Start time:10:38:41
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.123 --initial-client-data=0x230,0x234,0x238,0x22c,0x208,0x7ff79d2f673c,0x7ff79d2f6748,0x7ff79d2f6758
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff79cda0000
                                                                                                                                                                                                                                                                                            File size:5'819'288 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:84762F0101AE1F06BCB76F70A0308FD0
                                                                                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:37
                                                                                                                                                                                                                                                                                            Start time:10:38:42
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:38
                                                                                                                                                                                                                                                                                            Start time:10:38:42
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                                                                                            Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized --lowered-browser
                                                                                                                                                                                                                                                                                            Imagebase:0x7ff627e70000
                                                                                                                                                                                                                                                                                            File size:1'493'400 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:94851594215654A9EFCE5F3C3830A9C1
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            General

                                                                                                                                                                                                                                                                                            Target ID:39
                                                                                                                                                                                                                                                                                            Start time:10:38:42
                                                                                                                                                                                                                                                                                            Start date:29/10/2024
                                                                                                                                                                                                                                                                                            Path:C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe
                                                                                                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                                                                                                            Commandline:"C:\Program Files (x86)\mudjfNbYLVXpdJfomFaPTueznQoHFrCdznduaLVartLUUISpHuHZ\EwdhIsAfAL.exe"
                                                                                                                                                                                                                                                                                            Imagebase:0x110000
                                                                                                                                                                                                                                                                                            File size:140'800 bytes
                                                                                                                                                                                                                                                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                                                                                                            Has elevated privileges:false
                                                                                                                                                                                                                                                                                            Has administrator privileges:false
                                                                                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                                                                              Execution Coverage:2.3%
                                                                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                                              Signature Coverage:5.7%
                                                                                                                                                                                                                                                                                              Total number of Nodes:777
                                                                                                                                                                                                                                                                                              Total number of Limit Nodes:25
                                                                                                                                                                                                                                                                                              execution_graph 15303 7ff73cc4dcec 15304 7ff73cc4dcf7 15303->15304 15312 7ff73cc56610 15304->15312 15325 7ff73cc4eee0 EnterCriticalSection 15312->15325 15326 7ff73cc474e8 15327 7ff73cc474f8 15326->15327 15343 7ff73cc510b4 15327->15343 15329 7ff73cc47504 15349 7ff73cc472e4 15329->15349 15331 7ff73cc47e58 7 API calls 15333 7ff73cc4759d 15331->15333 15332 7ff73cc4751c _RTC_Initialize 15341 7ff73cc47571 15332->15341 15354 7ff73cc47494 15332->15354 15335 7ff73cc47531 15357 7ff73cc505ac 15335->15357 15341->15331 15342 7ff73cc4758d 15341->15342 15344 7ff73cc510c5 15343->15344 15345 7ff73cc4ee78 _set_fmode 11 API calls 15344->15345 15348 7ff73cc510cd 15344->15348 15346 7ff73cc510dc 15345->15346 15347 7ff73cc4ed0c _invalid_parameter_noinfo 47 API calls 15346->15347 15347->15348 15348->15329 15350 7ff73cc472f5 15349->15350 15353 7ff73cc472fa __scrt_acquire_startup_lock 15349->15353 15351 7ff73cc47e58 7 API calls 15350->15351 15350->15353 15352 7ff73cc4736e 15351->15352 15353->15332 15382 7ff73cc47458 15354->15382 15356 7ff73cc4749d 15356->15335 15358 7ff73cc4753d 15357->15358 15359 7ff73cc505cc 15357->15359 15358->15341 15381 7ff73cc48158 InitializeSListHead 15358->15381 15360 7ff73cc505ea GetModuleFileNameW 15359->15360 15361 7ff73cc505d4 15359->15361 15365 7ff73cc50615 15360->15365 15362 7ff73cc4ee78 _set_fmode 11 API calls 15361->15362 15363 7ff73cc505d9 15362->15363 15364 7ff73cc4ed0c _invalid_parameter_noinfo 47 API calls 15363->15364 15364->15358 15366 7ff73cc5054c 11 API calls 15365->15366 15367 7ff73cc50655 15366->15367 15368 7ff73cc5065d 15367->15368 15372 7ff73cc50675 15367->15372 15369 7ff73cc4ee78 _set_fmode 11 API calls 15368->15369 15370 7ff73cc50662 15369->15370 15371 7ff73cc54984 __free_lconv_num 11 API calls 15370->15371 15371->15358 15373 7ff73cc50697 15372->15373 15375 7ff73cc506dc 15372->15375 15376 7ff73cc506c3 15372->15376 15374 7ff73cc54984 __free_lconv_num 11 API calls 15373->15374 15374->15358 15379 7ff73cc54984 __free_lconv_num 11 API calls 15375->15379 15377 7ff73cc54984 __free_lconv_num 11 API calls 15376->15377 15378 7ff73cc506cc 15377->15378 15380 7ff73cc54984 __free_lconv_num 11 API calls 15378->15380 15379->15373 15380->15358 15383 7ff73cc47472 15382->15383 15385 7ff73cc4746b 15382->15385 15386 7ff73cc50d48 15383->15386 15385->15356 15389 7ff73cc50984 15386->15389 15396 7ff73cc4eee0 EnterCriticalSection 15389->15396 13964 7ff73cc437e0 13965 7ff73cc4382b 13964->13965 13966 7ff73cc437f3 13964->13966 13966->13965 13969 7ff73cc4d098 13966->13969 13970 7ff73cc4d0a6 13969->13970 13972 7ff73cc4d0ad 13969->13972 13975 7ff73cc4ce68 13970->13975 13973 7ff73cc4381b 13972->13973 13978 7ff73cc4ce28 13972->13978 13985 7ff73cc4cd44 13975->13985 13993 7ff73cc4dd48 EnterCriticalSection 13978->13993 13992 7ff73cc4eee0 EnterCriticalSection 13985->13992 15696 7ff73cc544a4 15697 7ff73cc544a9 15696->15697 15701 7ff73cc544be 15696->15701 15702 7ff73cc544c4 15697->15702 15703 7ff73cc54506 15702->15703 15704 7ff73cc5450e 15702->15704 15706 7ff73cc54984 __free_lconv_num 11 API calls 15703->15706 15705 7ff73cc54984 __free_lconv_num 11 API calls 15704->15705 15707 7ff73cc5451b 15705->15707 15706->15704 15708 7ff73cc54984 __free_lconv_num 11 API calls 15707->15708 15709 7ff73cc54528 15708->15709 15710 7ff73cc54984 __free_lconv_num 11 API calls 15709->15710 15711 7ff73cc54535 15710->15711 15712 7ff73cc54984 __free_lconv_num 11 API calls 15711->15712 15713 7ff73cc54542 15712->15713 15714 7ff73cc54984 __free_lconv_num 11 API calls 15713->15714 15715 7ff73cc5454f 15714->15715 15716 7ff73cc54984 __free_lconv_num 11 API calls 15715->15716 15717 7ff73cc5455c 15716->15717 15718 7ff73cc54984 __free_lconv_num 11 API calls 15717->15718 15719 7ff73cc54569 15718->15719 15720 7ff73cc54984 __free_lconv_num 11 API calls 15719->15720 15721 7ff73cc54579 15720->15721 15722 7ff73cc54984 __free_lconv_num 11 API calls 15721->15722 15723 7ff73cc54589 15722->15723 15728 7ff73cc54374 15723->15728 15742 7ff73cc4eee0 EnterCriticalSection 15728->15742 12569 7ff73cc475cc 12590 7ff73cc472a8 12569->12590 12572 7ff73cc47718 12652 7ff73cc47e58 IsProcessorFeaturePresent 12572->12652 12573 7ff73cc475e8 __scrt_acquire_startup_lock 12575 7ff73cc47722 12573->12575 12581 7ff73cc47606 __scrt_release_startup_lock 12573->12581 12576 7ff73cc47e58 7 API calls 12575->12576 12578 7ff73cc4772d BuildCatchObjectHelperInternal 12576->12578 12577 7ff73cc4762b 12579 7ff73cc476b1 12598 7ff73cc47fa0 12579->12598 12581->12577 12581->12579 12641 7ff73cc5035c 12581->12641 12582 7ff73cc476b6 12601 7ff73cc42830 CommandLineToArgvW 12582->12601 12585 7ff73cc476d2 12646 7ff73cc47fe4 GetModuleHandleW 12585->12646 12587 7ff73cc476d9 12587->12578 12648 7ff73cc4742c 12587->12648 12591 7ff73cc472b0 12590->12591 12592 7ff73cc472bc __scrt_dllmain_crt_thread_attach 12591->12592 12593 7ff73cc472c9 12592->12593 12597 7ff73cc472c5 12592->12597 12659 7ff73cc50ebc 12593->12659 12597->12572 12597->12573 12702 7ff73cc613e0 12598->12702 12600 7ff73cc47fb7 GetStartupInfoW 12600->12582 12602 7ff73cc42b27 7 API calls 12601->12602 12629 7ff73cc42881 ctype 12601->12629 12603 7ff73cc42bec MonitorFromWindow GetMonitorInfoW CreateWindowExW 12602->12603 12604 7ff73cc42ddf 12602->12604 12603->12604 12605 7ff73cc42c8b 9 API calls 12603->12605 12727 7ff73cc47210 12604->12727 12605->12604 12607 7ff73cc42d99 12605->12607 12608 7ff73cc42da0 TranslateAcceleratorW 12607->12608 12610 7ff73cc42dc9 GetMessageW 12608->12610 12611 7ff73cc42db5 TranslateMessage DispatchMessageW 12608->12611 12610->12604 12610->12608 12611->12610 12612 7ff73cc42e0d 12736 7ff73cc4ed2c 12612->12736 12615 7ff73cc42e12 12741 7ff73cc42500 12615->12741 12616 7ff73cc42ea5 12618 7ff73cc42f5d KillTimer PostQuitMessage 12616->12618 12619 7ff73cc42ed4 12616->12619 12625 7ff73cc42f79 12618->12625 12623 7ff73cc42ed9 12619->12623 12624 7ff73cc42f42 BeginPaint EndPaint 12619->12624 12621 7ff73cc42e36 12752 7ff73cc49130 12621->12752 12627 7ff73cc42eec 12623->12627 12628 7ff73cc42ee1 DefWindowProcW 12623->12628 12624->12625 12631 7ff73cc47210 _log10_special 8 API calls 12625->12631 12626 7ff73cc42e47 12632 7ff73cc4ed2c _invalid_parameter_noinfo_noreturn 47 API calls 12626->12632 12627->12625 12630 7ff73cc42ef9 WaitForSingleObject 12627->12630 12628->12625 12629->12602 12629->12612 12629->12615 12629->12626 12636 7ff73cc42e4d 12629->12636 12640 7ff73cc42e9f 12629->12640 12707 7ff73cc44de0 12629->12707 12713 7ff73cc45170 12629->12713 12630->12625 12633 7ff73cc42f14 KillTimer SendMessageW 12630->12633 12634 7ff73cc42f88 12631->12634 12632->12636 12633->12625 12634->12585 12637 7ff73cc42500 51 API calls 12636->12637 12638 7ff73cc42e8e 12637->12638 12639 7ff73cc49130 std::_Xinvalid_argument 2 API calls 12638->12639 12639->12640 12704 7ff73cc45150 12640->12704 12642 7ff73cc50373 12641->12642 12643 7ff73cc50394 12641->12643 12642->12579 13678 7ff73cc52b00 12643->13678 12647 7ff73cc47ff5 12646->12647 12647->12587 12650 7ff73cc4743d 12648->12650 12649 7ff73cc4744d 12649->12577 12650->12649 12651 7ff73cc49228 7 API calls 12650->12651 12651->12649 12653 7ff73cc47e7e _invalid_parameter_noinfo_noreturn __scrt_get_show_window_mode 12652->12653 12654 7ff73cc47e9d RtlCaptureContext RtlLookupFunctionEntry 12653->12654 12655 7ff73cc47f02 __scrt_get_show_window_mode 12654->12655 12656 7ff73cc47ec6 RtlVirtualUnwind 12654->12656 12657 7ff73cc47f34 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 12655->12657 12656->12655 12658 7ff73cc47f82 _invalid_parameter_noinfo_noreturn 12657->12658 12658->12575 12660 7ff73cc5a5cc 12659->12660 12661 7ff73cc472ce 12660->12661 12669 7ff73cc55670 12660->12669 12661->12597 12663 7ff73cc49228 12661->12663 12664 7ff73cc4923a 12663->12664 12665 7ff73cc49230 12663->12665 12664->12597 12681 7ff73cc49618 12665->12681 12680 7ff73cc4eee0 EnterCriticalSection 12669->12680 12671 7ff73cc55680 12672 7ff73cc5a914 53 API calls 12671->12672 12673 7ff73cc55689 12672->12673 12675 7ff73cc55478 55 API calls 12673->12675 12679 7ff73cc55697 12673->12679 12674 7ff73cc4ef34 std::_Locinfo::_Locinfo_ctor LeaveCriticalSection 12676 7ff73cc556a3 12674->12676 12677 7ff73cc55692 12675->12677 12676->12660 12678 7ff73cc55568 GetStdHandle GetFileType 12677->12678 12678->12679 12679->12674 12682 7ff73cc49627 12681->12682 12684 7ff73cc49235 12681->12684 12689 7ff73cc4ca34 12682->12689 12685 7ff73cc4c7c0 12684->12685 12686 7ff73cc4c7eb 12685->12686 12687 7ff73cc4c7ce DeleteCriticalSection 12686->12687 12688 7ff73cc4c7ef 12686->12688 12687->12686 12688->12664 12693 7ff73cc4c89c 12689->12693 12699 7ff73cc4c986 TlsFree 12693->12699 12700 7ff73cc4c8e0 __vcrt_FlsAlloc 12693->12700 12694 7ff73cc4c90e LoadLibraryExW 12696 7ff73cc4c9ad 12694->12696 12697 7ff73cc4c92f GetLastError 12694->12697 12695 7ff73cc4c9cd GetProcAddress 12695->12699 12696->12695 12698 7ff73cc4c9c4 FreeLibrary 12696->12698 12697->12700 12698->12695 12700->12694 12700->12695 12700->12699 12701 7ff73cc4c951 LoadLibraryExW 12700->12701 12701->12696 12701->12700 12703 7ff73cc613d0 12702->12703 12703->12600 12703->12703 12757 7ff73cc46758 12704->12757 12708 7ff73cc44e08 12707->12708 12712 7ff73cc44ea5 12707->12712 12909 7ff73cc46d08 12708->12909 12712->12629 12714 7ff73cc451b9 12713->12714 12720 7ff73cc451ef 12714->12720 13495 7ff73cc45df0 12714->13495 12716 7ff73cc453b6 13528 7ff73cc467a0 __uncaught_exceptions 12716->13528 12718 7ff73cc453bb 12719 7ff73cc453c7 12718->12719 13532 7ff73cc45f50 12718->13532 12719->12629 12720->12716 12721 7ff73cc453f3 12720->12721 12723 7ff73cc42500 51 API calls 12721->12723 12724 7ff73cc45435 12723->12724 12725 7ff73cc49130 std::_Xinvalid_argument 2 API calls 12724->12725 12726 7ff73cc45446 12725->12726 12728 7ff73cc47219 12727->12728 12729 7ff73cc42df2 12728->12729 12730 7ff73cc47bb0 IsProcessorFeaturePresent 12728->12730 12729->12585 12731 7ff73cc47bc8 12730->12731 13564 7ff73cc47da8 RtlCaptureContext 12731->13564 12737 7ff73cc4eba4 _invalid_parameter_noinfo_noreturn 47 API calls 12736->12737 12738 7ff73cc4ed45 12737->12738 12739 7ff73cc4ed5c _invalid_parameter_noinfo_noreturn 17 API calls 12738->12739 12740 7ff73cc4ed5a 12739->12740 12742 7ff73cc42530 12741->12742 12742->12742 13569 7ff73cc45710 12742->13569 12744 7ff73cc42544 13583 7ff73cc414e0 12744->13583 12746 7ff73cc42592 ctype 12746->12621 12747 7ff73cc4255d 12747->12746 12748 7ff73cc4ed2c _invalid_parameter_noinfo_noreturn 47 API calls 12747->12748 12749 7ff73cc425b4 12748->12749 12750 7ff73cc48eec __std_exception_copy 49 API calls 12749->12750 12751 7ff73cc425ed 12750->12751 12751->12621 12753 7ff73cc4914f 12752->12753 12754 7ff73cc49178 RtlPcToFileHeader 12753->12754 12755 7ff73cc4919a RaiseException 12753->12755 12756 7ff73cc49190 12754->12756 12755->12626 12756->12755 12762 7ff73cc466a4 12757->12762 12760 7ff73cc49130 std::_Xinvalid_argument 2 API calls 12761 7ff73cc4677a 12760->12761 12765 7ff73cc48eec 12762->12765 12766 7ff73cc48f0d 12765->12766 12770 7ff73cc466d8 12765->12770 12767 7ff73cc48f42 12766->12767 12766->12770 12771 7ff73cc52b2c 12766->12771 12780 7ff73cc4e420 12767->12780 12770->12760 12772 7ff73cc52b39 12771->12772 12773 7ff73cc52b43 12771->12773 12772->12773 12777 7ff73cc52b5e 12772->12777 12787 7ff73cc4ee78 12773->12787 12776 7ff73cc52b56 12776->12767 12777->12776 12778 7ff73cc4ee78 _set_fmode 11 API calls 12777->12778 12779 7ff73cc52b4a 12778->12779 12790 7ff73cc4ed0c 12779->12790 12781 7ff73cc54984 12780->12781 12782 7ff73cc54989 HeapFree 12781->12782 12783 7ff73cc549ba 12781->12783 12782->12783 12784 7ff73cc549a4 GetLastError 12782->12784 12783->12770 12785 7ff73cc549b1 __free_lconv_num 12784->12785 12786 7ff73cc4ee78 _set_fmode 11 API calls 12785->12786 12786->12783 12793 7ff73cc5479c GetLastError 12787->12793 12789 7ff73cc4ee81 12789->12779 12843 7ff73cc4eba4 12790->12843 12794 7ff73cc547dd FlsSetValue 12793->12794 12799 7ff73cc547c0 12793->12799 12795 7ff73cc547cd 12794->12795 12796 7ff73cc547ef 12794->12796 12797 7ff73cc54849 SetLastError 12795->12797 12810 7ff73cc55c7c 12796->12810 12797->12789 12799->12794 12799->12795 12801 7ff73cc5481c FlsSetValue 12803 7ff73cc54828 FlsSetValue 12801->12803 12804 7ff73cc5483a 12801->12804 12802 7ff73cc5480c FlsSetValue 12805 7ff73cc54815 12802->12805 12803->12805 12823 7ff73cc543d4 12804->12823 12817 7ff73cc54984 12805->12817 12809 7ff73cc54984 __free_lconv_num 5 API calls 12809->12797 12811 7ff73cc55c8d _Getctype 12810->12811 12812 7ff73cc55cde 12811->12812 12813 7ff73cc55cc2 HeapAlloc 12811->12813 12828 7ff73cc4fe98 12811->12828 12815 7ff73cc4ee78 _set_fmode 10 API calls 12812->12815 12813->12811 12814 7ff73cc547fe 12813->12814 12814->12801 12814->12802 12815->12814 12818 7ff73cc54989 HeapFree 12817->12818 12819 7ff73cc549ba 12817->12819 12818->12819 12820 7ff73cc549a4 GetLastError 12818->12820 12819->12795 12821 7ff73cc549b1 __free_lconv_num 12820->12821 12822 7ff73cc4ee78 _set_fmode 9 API calls 12821->12822 12822->12819 12831 7ff73cc542ac 12823->12831 12829 7ff73cc4fed8 std::_Facet_Register EnterCriticalSection LeaveCriticalSection 12828->12829 12830 7ff73cc4feaa 12829->12830 12830->12811 12832 7ff73cc4eee0 std::_Locinfo::_Locinfo_ctor EnterCriticalSection 12831->12832 12833 7ff73cc542c8 12832->12833 12834 7ff73cc4ef34 std::_Locinfo::_Locinfo_ctor LeaveCriticalSection 12833->12834 12835 7ff73cc542e0 12834->12835 12836 7ff73cc5432c 12835->12836 12837 7ff73cc4eee0 std::_Locinfo::_Locinfo_ctor EnterCriticalSection 12836->12837 12838 7ff73cc54348 12837->12838 12839 7ff73cc545bc Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 12838->12839 12840 7ff73cc5435e 12839->12840 12841 7ff73cc4ef34 std::_Locinfo::_Locinfo_ctor LeaveCriticalSection 12840->12841 12842 7ff73cc54366 12841->12842 12842->12809 12844 7ff73cc4ebcf 12843->12844 12851 7ff73cc4ec40 12844->12851 12847 7ff73cc4ec19 12849 7ff73cc4ec2e 12847->12849 12850 7ff73cc4cec8 _invalid_parameter_noinfo_noreturn 47 API calls 12847->12850 12849->12776 12850->12849 12870 7ff73cc4e988 12851->12870 12855 7ff73cc4ebf6 12855->12847 12861 7ff73cc4cec8 12855->12861 12862 7ff73cc4cf1b 12861->12862 12863 7ff73cc4cedb GetLastError 12861->12863 12862->12847 12864 7ff73cc4ceeb 12863->12864 12883 7ff73cc54864 12864->12883 12867 7ff73cc4cf29 12900 7ff73cc4fc48 12867->12900 12871 7ff73cc4e9a4 GetLastError 12870->12871 12872 7ff73cc4e9df 12870->12872 12873 7ff73cc4e9b4 12871->12873 12872->12855 12876 7ff73cc4e9f4 12872->12876 12874 7ff73cc54864 _invalid_parameter_noinfo_noreturn 16 API calls 12873->12874 12875 7ff73cc4e9cf SetLastError 12874->12875 12875->12872 12877 7ff73cc4ea10 GetLastError SetLastError 12876->12877 12878 7ff73cc4ea28 12876->12878 12877->12878 12878->12855 12879 7ff73cc4ed5c IsProcessorFeaturePresent 12878->12879 12880 7ff73cc4ed6f 12879->12880 12881 7ff73cc4ea40 _invalid_parameter_noinfo_noreturn 14 API calls 12880->12881 12882 7ff73cc4ed8a GetCurrentProcess TerminateProcess 12881->12882 12884 7ff73cc5489e FlsSetValue 12883->12884 12885 7ff73cc54883 FlsGetValue 12883->12885 12887 7ff73cc548ab 12884->12887 12888 7ff73cc4cf06 SetLastError 12884->12888 12886 7ff73cc54898 12885->12886 12885->12888 12886->12884 12889 7ff73cc55c7c _Getctype 11 API calls 12887->12889 12888->12862 12888->12867 12890 7ff73cc548ba 12889->12890 12891 7ff73cc548d8 FlsSetValue 12890->12891 12892 7ff73cc548c8 FlsSetValue 12890->12892 12894 7ff73cc548e4 FlsSetValue 12891->12894 12895 7ff73cc548f6 12891->12895 12893 7ff73cc548d1 12892->12893 12896 7ff73cc54984 __free_lconv_num 11 API calls 12893->12896 12894->12893 12897 7ff73cc543d4 _Getctype 11 API calls 12895->12897 12896->12888 12898 7ff73cc548fe 12897->12898 12899 7ff73cc54984 __free_lconv_num 11 API calls 12898->12899 12899->12888 12901 7ff73cc58cd4 BuildCatchObjectHelperInternal EnterCriticalSection LeaveCriticalSection 12900->12901 12902 7ff73cc4fc51 12901->12902 12903 7ff73cc4fc60 12902->12903 12904 7ff73cc58d24 BuildCatchObjectHelperInternal 46 API calls 12902->12904 12905 7ff73cc4fc69 IsProcessorFeaturePresent 12903->12905 12907 7ff73cc4fc93 BuildCatchObjectHelperInternal 12903->12907 12904->12903 12906 7ff73cc4fc78 12905->12906 12908 7ff73cc4ea40 _invalid_parameter_noinfo_noreturn 14 API calls 12906->12908 12908->12907 12910 7ff73cc46d4e 12909->12910 12913 7ff73cc44e1b 12910->12913 12936 7ff73cc4f378 12910->12936 12913->12712 12917 7ff73cc455d0 12913->12917 13360 7ff73cc464dc 12917->13360 12919 7ff73cc45600 12920 7ff73cc464dc std::_Lockit::_Lockit 6 API calls 12919->12920 12926 7ff73cc4564f 12919->12926 12921 7ff73cc45625 12920->12921 13364 7ff73cc46554 12921->13364 12922 7ff73cc4569c 12923 7ff73cc46554 std::_Lockit::~_Lockit LeaveCriticalSection 12922->12923 12925 7ff73cc456e0 12923->12925 12927 7ff73cc47210 _log10_special 8 API calls 12925->12927 12926->12922 13368 7ff73cc419a0 12926->13368 12929 7ff73cc456f0 12927->12929 12929->12712 12931 7ff73cc456b4 13402 7ff73cc46904 12931->13402 12932 7ff73cc45703 13405 7ff73cc418c0 12932->13405 12937 7ff73cc4f2ac 12936->12937 12938 7ff73cc4f2d2 12937->12938 12940 7ff73cc4f305 12937->12940 12939 7ff73cc4ee78 _set_fmode 11 API calls 12938->12939 12941 7ff73cc4f2d7 12939->12941 12942 7ff73cc4f30b 12940->12942 12943 7ff73cc4f318 12940->12943 12944 7ff73cc4ed0c _invalid_parameter_noinfo 47 API calls 12941->12944 12945 7ff73cc4ee78 _set_fmode 11 API calls 12942->12945 12971 7ff73cc54c64 12943->12971 12954 7ff73cc46d81 12944->12954 12945->12954 12954->12913 12955 7ff73cc4e8ec 12954->12955 12956 7ff73cc4e91c 12955->12956 13337 7ff73cc4e5e4 12956->13337 12959 7ff73cc4e95d 12961 7ff73cc46d9c 12959->12961 12962 7ff73cc4cec8 _invalid_parameter_noinfo_noreturn 47 API calls 12959->12962 12960 7ff73cc4cec8 _invalid_parameter_noinfo_noreturn 47 API calls 12960->12959 12961->12913 12963 7ff73cc4d224 12961->12963 12962->12961 12964 7ff73cc4d254 12963->12964 13349 7ff73cc4d100 12964->13349 12966 7ff73cc4d26d 12967 7ff73cc4cec8 _invalid_parameter_noinfo_noreturn 47 API calls 12966->12967 12968 7ff73cc4d292 12966->12968 12967->12968 12969 7ff73cc4d2a7 12968->12969 12970 7ff73cc4cec8 _invalid_parameter_noinfo_noreturn 47 API calls 12968->12970 12969->12913 12970->12969 12984 7ff73cc4eee0 EnterCriticalSection 12971->12984 13338 7ff73cc4e64e 13337->13338 13339 7ff73cc4e60e 13337->13339 13338->13339 13341 7ff73cc4e65a 13338->13341 13340 7ff73cc4ec40 _invalid_parameter_noinfo_noreturn 47 API calls 13339->13340 13342 7ff73cc4e635 13340->13342 13348 7ff73cc4dd48 EnterCriticalSection 13341->13348 13342->12959 13342->12960 13350 7ff73cc4d11b 13349->13350 13351 7ff73cc4d149 13349->13351 13352 7ff73cc4ec40 _invalid_parameter_noinfo_noreturn 47 API calls 13350->13352 13353 7ff73cc4d13b 13351->13353 13359 7ff73cc4dd48 EnterCriticalSection 13351->13359 13352->13353 13353->12966 13361 7ff73cc464eb 13360->13361 13363 7ff73cc464f0 13360->13363 13411 7ff73cc4ef50 13361->13411 13363->12919 13365 7ff73cc46568 13364->13365 13366 7ff73cc4655f LeaveCriticalSection 13364->13366 13365->12926 13369 7ff73cc419cc 13368->13369 13370 7ff73cc41b10 13368->13370 13369->13370 13444 7ff73cc47230 13369->13444 13370->12931 13370->12932 13373 7ff73cc464dc std::_Lockit::_Lockit 6 API calls 13374 7ff73cc41a10 13373->13374 13375 7ff73cc41b2e 13374->13375 13376 7ff73cc41a4c 13374->13376 13460 7ff73cc4677c 13375->13460 13453 7ff73cc46ab4 13376->13453 13403 7ff73cc47230 std::_Facet_Register 51 API calls 13402->13403 13404 7ff73cc46917 13403->13404 13404->12922 13406 7ff73cc418ce Concurrency::cancel_current_task 13405->13406 13407 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13406->13407 13408 7ff73cc418df 13407->13408 13409 7ff73cc48eec __std_exception_copy 49 API calls 13408->13409 13410 7ff73cc41909 13409->13410 13414 7ff73cc5644c 13411->13414 13435 7ff73cc55da8 13414->13435 13417 7ff73cc55da8 __crtLCMapStringW 5 API calls 13418 7ff73cc5648b 13417->13418 13419 7ff73cc55da8 __crtLCMapStringW 5 API calls 13418->13419 13420 7ff73cc564aa 13419->13420 13421 7ff73cc55da8 __crtLCMapStringW 5 API calls 13420->13421 13422 7ff73cc564c9 13421->13422 13423 7ff73cc55da8 __crtLCMapStringW 5 API calls 13422->13423 13424 7ff73cc564e8 13423->13424 13425 7ff73cc55da8 __crtLCMapStringW 5 API calls 13424->13425 13426 7ff73cc56507 13425->13426 13427 7ff73cc55da8 __crtLCMapStringW 5 API calls 13426->13427 13428 7ff73cc56526 13427->13428 13429 7ff73cc55da8 __crtLCMapStringW 5 API calls 13428->13429 13430 7ff73cc56545 13429->13430 13431 7ff73cc55da8 __crtLCMapStringW 5 API calls 13430->13431 13432 7ff73cc56564 13431->13432 13433 7ff73cc55da8 __crtLCMapStringW 5 API calls 13432->13433 13434 7ff73cc56583 13433->13434 13436 7ff73cc55e05 13435->13436 13442 7ff73cc55e00 __vcrt_FlsAlloc 13435->13442 13436->13417 13437 7ff73cc55e35 LoadLibraryExW 13439 7ff73cc55f0a 13437->13439 13440 7ff73cc55e5a GetLastError 13437->13440 13438 7ff73cc55f2a GetProcAddress 13438->13436 13439->13438 13441 7ff73cc55f21 FreeLibrary 13439->13441 13440->13442 13441->13438 13442->13436 13442->13437 13442->13438 13443 7ff73cc55e94 LoadLibraryExW 13442->13443 13443->13439 13443->13442 13445 7ff73cc4723b 13444->13445 13446 7ff73cc419df 13445->13446 13447 7ff73cc4fe98 std::_Facet_Register 2 API calls 13445->13447 13448 7ff73cc4725a 13445->13448 13446->13373 13447->13445 13449 7ff73cc47265 13448->13449 13465 7ff73cc47e1c 13448->13465 13469 7ff73cc411f0 13449->13469 13475 7ff73cc4f260 13453->13475 13492 7ff73cc466ec 13460->13492 13463 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13464 7ff73cc4679e 13463->13464 13466 7ff73cc47e2a std::bad_alloc::bad_alloc 13465->13466 13467 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13466->13467 13468 7ff73cc47e3b 13467->13468 13470 7ff73cc411fe Concurrency::cancel_current_task 13469->13470 13471 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13470->13471 13472 7ff73cc4120f 13471->13472 13473 7ff73cc48eec __std_exception_copy 49 API calls 13472->13473 13474 7ff73cc41239 13473->13474 13476 7ff73cc5644c std::_Locinfo::_Locinfo_ctor 5 API calls 13475->13476 13477 7ff73cc4f276 13476->13477 13484 7ff73cc4ef84 13477->13484 13491 7ff73cc4eee0 EnterCriticalSection 13484->13491 13493 7ff73cc48eec __std_exception_copy 49 API calls 13492->13493 13494 7ff73cc46720 13493->13494 13494->13463 13496 7ff73cc45eb0 13495->13496 13497 7ff73cc45e2e 13495->13497 13499 7ff73cc47210 _log10_special 8 API calls 13496->13499 13551 7ff73cc45d20 13497->13551 13500 7ff73cc45ede 13499->13500 13500->12720 13502 7ff73cc45e9d 13503 7ff73cc467a0 __uncaught_exceptions 9 API calls 13502->13503 13504 7ff73cc45ea2 13503->13504 13504->13496 13505 7ff73cc45f50 60 API calls 13504->13505 13505->13496 13506 7ff73cc45ef3 13507 7ff73cc42500 51 API calls 13506->13507 13508 7ff73cc45f35 13507->13508 13509 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13508->13509 13511 7ff73cc45f46 13509->13511 13510 7ff73cc45f99 13510->12720 13511->13510 13512 7ff73cc42500 51 API calls 13511->13512 13513 7ff73cc45fdf 13512->13513 13514 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13513->13514 13515 7ff73cc45ff0 13514->13515 13516 7ff73cc45df0 60 API calls 13515->13516 13521 7ff73cc46089 13515->13521 13516->13521 13517 7ff73cc46250 13518 7ff73cc467a0 __uncaught_exceptions 9 API calls 13517->13518 13519 7ff73cc46255 13518->13519 13520 7ff73cc46261 13519->13520 13523 7ff73cc45f50 60 API calls 13519->13523 13520->12720 13521->13517 13522 7ff73cc4628e 13521->13522 13524 7ff73cc42500 51 API calls 13522->13524 13523->13520 13525 7ff73cc462d0 13524->13525 13526 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13525->13526 13527 7ff73cc462e1 13526->13527 13528->12718 13529 7ff73cc491d8 13528->13529 13555 7ff73cc49580 13529->13555 13533 7ff73cc45f99 13532->13533 13534 7ff73cc45f67 13532->13534 13533->12719 13534->13533 13535 7ff73cc42500 51 API calls 13534->13535 13536 7ff73cc45fdf 13535->13536 13537 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13536->13537 13538 7ff73cc45ff0 13537->13538 13539 7ff73cc46089 13538->13539 13540 7ff73cc45df0 60 API calls 13538->13540 13541 7ff73cc46250 13539->13541 13544 7ff73cc4628e 13539->13544 13540->13539 13542 7ff73cc467a0 __uncaught_exceptions 9 API calls 13541->13542 13543 7ff73cc46255 13542->13543 13545 7ff73cc45f50 60 API calls 13543->13545 13546 7ff73cc46261 13543->13546 13547 7ff73cc42500 51 API calls 13544->13547 13545->13546 13546->12719 13548 7ff73cc462d0 13547->13548 13549 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13548->13549 13550 7ff73cc462e1 13549->13550 13552 7ff73cc45d49 13551->13552 13553 7ff73cc45df0 60 API calls 13552->13553 13554 7ff73cc45d5e 13552->13554 13553->13554 13554->13502 13554->13506 13556 7ff73cc49597 GetLastError 13555->13556 13557 7ff73cc491e1 13555->13557 13560 7ff73cc4ca7c 13556->13560 13557->12718 13561 7ff73cc4c89c __vcrt_FlsAlloc 5 API calls 13560->13561 13562 7ff73cc4caa3 TlsGetValue 13561->13562 13565 7ff73cc47dc2 RtlLookupFunctionEntry 13564->13565 13566 7ff73cc47dd8 RtlVirtualUnwind 13565->13566 13567 7ff73cc47bdb 13565->13567 13566->13565 13566->13567 13568 7ff73cc47b7c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 13567->13568 13570 7ff73cc45804 13569->13570 13573 7ff73cc45736 13569->13573 13606 7ff73cc41290 13570->13606 13575 7ff73cc4573c _Yarn 13573->13575 13576 7ff73cc4576c 13573->13576 13577 7ff73cc457c5 13573->13577 13574 7ff73cc47230 std::_Facet_Register 51 API calls 13578 7ff73cc45782 13574->13578 13575->12744 13576->13574 13579 7ff73cc457fe 13576->13579 13580 7ff73cc47230 std::_Facet_Register 51 API calls 13577->13580 13578->13575 13582 7ff73cc4ed2c _invalid_parameter_noinfo_noreturn 47 API calls 13578->13582 13581 7ff73cc411f0 Concurrency::cancel_current_task 51 API calls 13579->13581 13580->13575 13581->13570 13582->13579 13585 7ff73cc4152a 13583->13585 13584 7ff73cc41290 51 API calls 13587 7ff73cc416c4 13584->13587 13586 7ff73cc41546 _Yarn 13585->13586 13591 7ff73cc415ce 13585->13591 13594 7ff73cc4156e 13585->13594 13600 7ff73cc416be 13585->13600 13597 7ff73cc416b3 13586->13597 13619 7ff73cc41380 13586->13619 13655 7ff73cc48f7c 13587->13655 13590 7ff73cc47230 std::_Facet_Register 51 API calls 13590->13586 13595 7ff73cc47230 std::_Facet_Register 51 API calls 13591->13595 13592 7ff73cc4160e 13596 7ff73cc48eec __std_exception_copy 49 API calls 13592->13596 13593 7ff73cc416b8 13599 7ff73cc411f0 Concurrency::cancel_current_task 51 API calls 13593->13599 13594->13590 13594->13593 13595->13586 13601 7ff73cc41640 13596->13601 13602 7ff73cc4ed2c _invalid_parameter_noinfo_noreturn 47 API calls 13597->13602 13598 7ff73cc416f2 ctype 13598->12747 13599->13600 13600->13584 13601->13597 13603 7ff73cc4167e ctype 13601->13603 13602->13593 13604 7ff73cc47210 _log10_special 8 API calls 13603->13604 13605 7ff73cc416a5 13604->13605 13605->12747 13611 7ff73cc46734 13606->13611 13608 7ff73cc412a0 13609 7ff73cc48eec __std_exception_copy 49 API calls 13608->13609 13610 7ff73cc412d9 13609->13610 13616 7ff73cc465e4 13611->13616 13614 7ff73cc49130 std::_Xinvalid_argument 2 API calls 13615 7ff73cc46756 13614->13615 13617 7ff73cc48eec __std_exception_copy 49 API calls 13616->13617 13618 7ff73cc46618 13617->13618 13618->13614 13620 7ff73cc413cb 13619->13620 13621 7ff73cc413b6 13619->13621 13623 7ff73cc44d50 51 API calls 13620->13623 13659 7ff73cc44d50 13621->13659 13624 7ff73cc413fc 13623->13624 13625 7ff73cc41435 ctype 13624->13625 13628 7ff73cc414ca 13624->13628 13626 7ff73cc41493 ctype 13625->13626 13631 7ff73cc414cf 13625->13631 13627 7ff73cc47210 _log10_special 8 API calls 13626->13627 13629 7ff73cc414ba 13627->13629 13630 7ff73cc4ed2c _invalid_parameter_noinfo_noreturn 47 API calls 13628->13630 13629->13592 13630->13631 13632 7ff73cc4ed2c _invalid_parameter_noinfo_noreturn 47 API calls 13631->13632 13637 7ff73cc414d5 13632->13637 13633 7ff73cc416be 13634 7ff73cc41290 51 API calls 13633->13634 13635 7ff73cc416c4 13634->13635 13636 7ff73cc48f7c __std_exception_destroy 13 API calls 13635->13636 13640 7ff73cc416f2 ctype 13636->13640 13637->13633 13641 7ff73cc415ce 13637->13641 13642 7ff73cc4156e 13637->13642 13644 7ff73cc41546 _Yarn 13637->13644 13638 7ff73cc41380 51 API calls 13643 7ff73cc4160e 13638->13643 13639 7ff73cc47230 std::_Facet_Register 51 API calls 13639->13644 13640->13592 13646 7ff73cc47230 std::_Facet_Register 51 API calls 13641->13646 13642->13639 13645 7ff73cc416b8 13642->13645 13647 7ff73cc48eec __std_exception_copy 49 API calls 13643->13647 13644->13638 13648 7ff73cc416b3 13644->13648 13649 7ff73cc411f0 Concurrency::cancel_current_task 51 API calls 13645->13649 13646->13644 13650 7ff73cc41640 13647->13650 13651 7ff73cc4ed2c _invalid_parameter_noinfo_noreturn 47 API calls 13648->13651 13649->13633 13650->13648 13652 7ff73cc4167e ctype 13650->13652 13651->13645 13653 7ff73cc47210 _log10_special 8 API calls 13652->13653 13654 7ff73cc416a5 13653->13654 13654->13592 13656 7ff73cc48f8b 13655->13656 13657 7ff73cc48f93 13655->13657 13658 7ff73cc4e420 _Yarn 13 API calls 13656->13658 13657->13598 13658->13657 13660 7ff73cc44db2 13659->13660 13663 7ff73cc44d73 _Yarn 13659->13663 13664 7ff73cc45980 13660->13664 13662 7ff73cc44dcb 13662->13620 13663->13620 13666 7ff73cc459b8 13664->13666 13676 7ff73cc45b01 13664->13676 13665 7ff73cc41290 51 API calls 13668 7ff73cc45b07 13665->13668 13667 7ff73cc45a10 13666->13667 13670 7ff73cc45a4c 13666->13670 13675 7ff73cc45a03 _Yarn 13666->13675 13669 7ff73cc47230 std::_Facet_Register 51 API calls 13667->13669 13672 7ff73cc45afb 13667->13672 13669->13675 13671 7ff73cc47230 std::_Facet_Register 51 API calls 13670->13671 13671->13675 13674 7ff73cc411f0 Concurrency::cancel_current_task 51 API calls 13672->13674 13673 7ff73cc4ed2c _invalid_parameter_noinfo_noreturn 47 API calls 13673->13672 13674->13676 13675->13673 13677 7ff73cc45aac _Yarn ctype 13675->13677 13676->13665 13677->13662 13679 7ff73cc54624 _Getctype 47 API calls 13678->13679 13680 7ff73cc52b09 13679->13680 13681 7ff73cc4fc48 BuildCatchObjectHelperInternal 47 API calls 13680->13681 13682 7ff73cc52b29 13681->13682 16079 7ff73cc62295 16080 7ff73cc622a4 16079->16080 16081 7ff73cc622ae 16079->16081 16083 7ff73cc4ef34 LeaveCriticalSection 16080->16083 13683 7ff73cc50191 13684 7ff73cc52b00 __GSHandlerCheck_EH 47 API calls 13683->13684 13685 7ff73cc50196 13684->13685 13686 7ff73cc501bd GetModuleHandleW 13685->13686 13687 7ff73cc50207 13685->13687 13686->13687 13693 7ff73cc501ca 13686->13693 13695 7ff73cc50094 13687->13695 13690 7ff73cc5024a 13693->13687 13709 7ff73cc502b8 GetModuleHandleExW 13693->13709 13715 7ff73cc4eee0 EnterCriticalSection 13695->13715 13697 7ff73cc500b0 13698 7ff73cc500cc 11 API calls 13697->13698 13699 7ff73cc500b9 13698->13699 13700 7ff73cc4ef34 std::_Locinfo::_Locinfo_ctor LeaveCriticalSection 13699->13700 13701 7ff73cc500c1 13700->13701 13701->13690 13702 7ff73cc50260 13701->13702 13716 7ff73cc50294 13702->13716 13704 7ff73cc5026d 13705 7ff73cc50271 GetCurrentProcess TerminateProcess 13704->13705 13706 7ff73cc50282 13704->13706 13705->13706 13707 7ff73cc502b8 3 API calls 13706->13707 13708 7ff73cc50289 ExitProcess 13707->13708 13710 7ff73cc502ec GetProcAddress 13709->13710 13711 7ff73cc50315 13709->13711 13712 7ff73cc502fe 13710->13712 13713 7ff73cc5031a FreeLibrary 13711->13713 13714 7ff73cc50321 13711->13714 13712->13711 13713->13714 13714->13687 13719 7ff73cc59350 13716->13719 13718 7ff73cc5029d 13718->13704 13720 7ff73cc59361 13719->13720 13721 7ff73cc5936f 13720->13721 13723 7ff73cc55f64 13720->13723 13721->13718 13724 7ff73cc55da8 __crtLCMapStringW 5 API calls 13723->13724 13725 7ff73cc55f8c 13724->13725 13725->13721 15181 7ff73cc51548 15184 7ff73cc51314 15181->15184 15191 7ff73cc4eee0 EnterCriticalSection 15184->15191 16178 7ff73cc5f850 16181 7ff73cc5a10c 16178->16181 16182 7ff73cc5a119 16181->16182 16186 7ff73cc5a15e 16181->16186 16187 7ff73cc546f8 16182->16187 16188 7ff73cc54709 FlsGetValue 16187->16188 16189 7ff73cc54724 FlsSetValue 16187->16189 16190 7ff73cc5471e 16188->16190 16191 7ff73cc54716 16188->16191 16189->16191 16192 7ff73cc54731 16189->16192 16190->16189 16193 7ff73cc5471c 16191->16193 16194 7ff73cc4fc48 BuildCatchObjectHelperInternal 47 API calls 16191->16194 16195 7ff73cc55c7c _Getctype 11 API calls 16192->16195 16207 7ff73cc59de4 16193->16207 16196 7ff73cc54799 16194->16196 16197 7ff73cc54740 16195->16197 16198 7ff73cc5475e FlsSetValue 16197->16198 16199 7ff73cc5474e FlsSetValue 16197->16199 16200 7ff73cc5477c 16198->16200 16201 7ff73cc5476a FlsSetValue 16198->16201 16202 7ff73cc54757 16199->16202 16203 7ff73cc543d4 _Getctype 11 API calls 16200->16203 16201->16202 16204 7ff73cc54984 __free_lconv_num 11 API calls 16202->16204 16205 7ff73cc54784 16203->16205 16204->16191 16206 7ff73cc54984 __free_lconv_num 11 API calls 16205->16206 16206->16193 16230 7ff73cc5a054 16207->16230 16212 7ff73cc59e36 16212->16186 16213 7ff73cc570c4 std::_Locinfo::_Locinfo_ctor 12 API calls 16214 7ff73cc59e47 16213->16214 16215 7ff73cc59e4f 16214->16215 16217 7ff73cc59e5e 16214->16217 16216 7ff73cc54984 __free_lconv_num 11 API calls 16215->16216 16216->16212 16217->16217 16248 7ff73cc5a188 16217->16248 16220 7ff73cc59f5a 16221 7ff73cc4ee78 _set_fmode 11 API calls 16220->16221 16222 7ff73cc59f5f 16221->16222 16225 7ff73cc54984 __free_lconv_num 11 API calls 16222->16225 16223 7ff73cc59fb5 16224 7ff73cc5a01c 16223->16224 16259 7ff73cc59914 16223->16259 16228 7ff73cc54984 __free_lconv_num 11 API calls 16224->16228 16225->16212 16226 7ff73cc59f74 16226->16223 16229 7ff73cc54984 __free_lconv_num 11 API calls 16226->16229 16228->16212 16229->16223 16231 7ff73cc5a077 16230->16231 16232 7ff73cc5a081 16231->16232 16274 7ff73cc4eee0 EnterCriticalSection 16231->16274 16234 7ff73cc59e19 16232->16234 16237 7ff73cc4fc48 BuildCatchObjectHelperInternal 47 API calls 16232->16237 16241 7ff73cc59ae4 16234->16241 16239 7ff73cc5a10b 16237->16239 16242 7ff73cc4fb34 TranslateName 47 API calls 16241->16242 16243 7ff73cc59af8 16242->16243 16244 7ff73cc59b04 GetOEMCP 16243->16244 16245 7ff73cc59b16 16243->16245 16247 7ff73cc59b2b 16244->16247 16246 7ff73cc59b1b GetACP 16245->16246 16245->16247 16246->16247 16247->16212 16247->16213 16249 7ff73cc59ae4 49 API calls 16248->16249 16250 7ff73cc5a1b5 16249->16250 16251 7ff73cc5a30b 16250->16251 16253 7ff73cc5a1f2 IsValidCodePage 16250->16253 16258 7ff73cc5a20c __scrt_get_show_window_mode 16250->16258 16252 7ff73cc47210 _log10_special 8 API calls 16251->16252 16254 7ff73cc59f51 16252->16254 16253->16251 16255 7ff73cc5a203 16253->16255 16254->16220 16254->16226 16256 7ff73cc5a232 GetCPInfo 16255->16256 16255->16258 16256->16251 16256->16258 16275 7ff73cc59bfc 16258->16275 16346 7ff73cc4eee0 EnterCriticalSection 16259->16346 16276 7ff73cc59c39 GetCPInfo 16275->16276 16277 7ff73cc59d2f 16275->16277 16276->16277 16282 7ff73cc59c4c 16276->16282 16278 7ff73cc47210 _log10_special 8 API calls 16277->16278 16279 7ff73cc59dce 16278->16279 16279->16251 16286 7ff73cc581b0 16282->16286 16287 7ff73cc4fb34 TranslateName 47 API calls 16286->16287 16288 7ff73cc581f2 16287->16288 16306 7ff73cc58fa0 16288->16306 16308 7ff73cc58fa9 MultiByteToWideChar 16306->16308

                                                                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                                                                              Function 00007FF73CC42830 Relevance: 77.4, APIs: 34, Strings: 10, Instructions: 449windowtimeregistryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 0 7ff73cc42830-7ff73cc4287b CommandLineToArgvW 1 7ff73cc42b27-7ff73cc42be6 LoadStringW * 2 LoadIconW LoadCursorW LoadIconW RegisterClassExW CoInitializeEx 0->1 2 7ff73cc42881-7ff73cc4289d 0->2 4 7ff73cc42bec-7ff73cc42c85 MonitorFromWindow GetMonitorInfoW CreateWindowExW 1->4 5 7ff73cc42de4 1->5 3 7ff73cc428a0-7ff73cc428a9 2->3 3->3 7 7ff73cc428ab-7ff73cc428d0 call 7ff73cc42700 3->7 4->5 8 7ff73cc42c8b-7ff73cc42d97 SetWindowLongW CreateWindowExW SendMessageW ShowWindow UpdateWindow CreateThread SetTimer LoadAcceleratorsW GetMessageW 4->8 6 7ff73cc42de6-7ff73cc42e0c call 7ff73cc47210 5->6 16 7ff73cc42adb-7ff73cc42adf 7->16 17 7ff73cc428d6-7ff73cc428eb 7->17 11 7ff73cc42d99 8->11 12 7ff73cc42ddf-7ff73cc42de2 8->12 13 7ff73cc42da0-7ff73cc42db3 TranslateAcceleratorW 11->13 12->6 18 7ff73cc42dc9-7ff73cc42ddd GetMessageW 13->18 19 7ff73cc42db5-7ff73cc42dc3 TranslateMessage DispatchMessageW 13->19 21 7ff73cc42ae1-7ff73cc42af3 16->21 22 7ff73cc42b16-7ff73cc42b21 16->22 20 7ff73cc428f0-7ff73cc428f8 17->20 18->12 18->13 19->18 23 7ff73cc428fa-7ff73cc42902 20->23 24 7ff73cc4290d-7ff73cc4291a 20->24 25 7ff73cc42b0e-7ff73cc42b11 call 7ff73cc474b4 21->25 26 7ff73cc42af5-7ff73cc42b08 21->26 22->1 22->2 23->20 27 7ff73cc42904-7ff73cc4290b 23->27 28 7ff73cc4291e-7ff73cc42921 24->28 25->22 26->25 29 7ff73cc42e0d-7ff73cc42e12 call 7ff73cc4ed2c 26->29 27->28 28->16 31 7ff73cc42927-7ff73cc4293e 28->31 38 7ff73cc42e13-7ff73cc42e47 call 7ff73cc41360 call 7ff73cc42500 call 7ff73cc49130 29->38 33 7ff73cc429d4 31->33 34 7ff73cc42944-7ff73cc4294b 31->34 36 7ff73cc429d7-7ff73cc429ed 33->36 37 7ff73cc42950-7ff73cc4295e 34->37 39 7ff73cc42ea0-7ff73cc42ece call 7ff73cc45150 36->39 40 7ff73cc429f3-7ff73cc42a44 call 7ff73cc42700 call 7ff73cc44de0 36->40 41 7ff73cc4297c-7ff73cc42982 37->41 42 7ff73cc42960-7ff73cc42964 37->42 74 7ff73cc42e48-7ff73cc42e4d call 7ff73cc4ed2c 38->74 58 7ff73cc42f5d-7ff73cc42f73 KillTimer PostQuitMessage 39->58 59 7ff73cc42ed4-7ff73cc42ed7 39->59 72 7ff73cc42a66-7ff73cc42a88 40->72 73 7ff73cc42a46-7ff73cc42a5e 40->73 49 7ff73cc429cb-7ff73cc429d2 41->49 50 7ff73cc42984-7ff73cc4299a 41->50 46 7ff73cc42979 42->46 47 7ff73cc42966-7ff73cc4296a 42->47 46->41 47->41 53 7ff73cc4296c-7ff73cc42977 47->53 49->33 55 7ff73cc429a0-7ff73cc429a8 50->55 53->46 53->47 56 7ff73cc429aa-7ff73cc429b2 55->56 57 7ff73cc429c5-7ff73cc429c9 55->57 56->55 63 7ff73cc429b4-7ff73cc429c3 56->63 57->37 66 7ff73cc42f79 58->66 64 7ff73cc42ed9-7ff73cc42edf 59->64 65 7ff73cc42f42-7ff73cc42f5b BeginPaint EndPaint 59->65 63->36 69 7ff73cc42eec-7ff73cc42ef3 64->69 70 7ff73cc42ee1-7ff73cc42ee7 DefWindowProcW 64->70 65->66 71 7ff73cc42f7b-7ff73cc42f90 call 7ff73cc47210 66->71 69->66 75 7ff73cc42ef9-7ff73cc42f12 WaitForSingleObject 69->75 70->71 78 7ff73cc42e4e-7ff73cc42e50 72->78 79 7ff73cc42a8e-7ff73cc42a9b call 7ff73cc45170 72->79 73->38 77 7ff73cc42a64 73->77 74->78 75->66 83 7ff73cc42f14-7ff73cc42f40 KillTimer SendMessageW 75->83 77->79 81 7ff73cc42e5b-7ff73cc42e6b 78->81 82 7ff73cc42e52-7ff73cc42e59 78->82 89 7ff73cc42a9d-7ff73cc42ab3 79->89 90 7ff73cc42ad3-7ff73cc42ad7 79->90 88 7ff73cc42e6f-7ff73cc42e9f call 7ff73cc41360 call 7ff73cc42500 call 7ff73cc49130 81->88 82->88 83->66 88->39 92 7ff73cc42ace call 7ff73cc474b4 89->92 93 7ff73cc42ab5-7ff73cc42ac8 89->93 90->16 92->90 93->74 93->92
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: MessageWindow$Load$CreateTimer$IconKillMonitorPaintSendStringTranslate_invalid_parameter_noinfo_noreturn$AcceleratorAcceleratorsArgvBeginClassCommandCursorDispatchFromInfoInitializeLineLongObjectPostProcQuitRegisterShowSingleThreadUpdateWait
                                                                                                                                                                                                                                                                                              • String ID: --silent --allusers=0$/log=$OPERAGXINSTALLER$OperaGXInstaller$P$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$msctls_progress32$s
                                                                                                                                                                                                                                                                                              • API String ID: 457931785-3592647864
                                                                                                                                                                                                                                                                                              • Opcode ID: 00bdcc120adc48b7ee0712ffadfd65604f0e378d3e4f2ef5230acc59e162aaff
                                                                                                                                                                                                                                                                                              • Instruction ID: 718f7a2c52eb72347f46115bffc36c1a5b64a3129dd64731ef66f595c3a0db90
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 00bdcc120adc48b7ee0712ffadfd65604f0e378d3e4f2ef5230acc59e162aaff
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD12E371B08A52A5FB10AB24E8453B9B3E2FB44BA4FC48235DA5D4BAD4DF3CE445D310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC42FA0 Relevance: 35.5, APIs: 14, Strings: 6, Instructions: 507filenetworkCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 100 7ff73cc42fa0-7ff73cc42ff3 SHGetFolderPathW 101 7ff73cc43032-7ff73cc4304c 100->101 102 7ff73cc42ff5-7ff73cc43004 100->102 104 7ff73cc43050-7ff73cc43058 101->104 103 7ff73cc43007-7ff73cc43031 call 7ff73cc47210 102->103 104->104 106 7ff73cc4305a-7ff73cc4309f call 7ff73cc42700 call 7ff73cc44f30 SHCreateDirectoryExW 104->106 112 7ff73cc4310d-7ff73cc4313e call 7ff73cc44f30 106->112 113 7ff73cc430a1-7ff73cc430a4 106->113 119 7ff73cc43140 112->119 120 7ff73cc43143-7ff73cc43150 112->120 113->112 114 7ff73cc430a6-7ff73cc430ab 113->114 114->112 116 7ff73cc430ad-7ff73cc430cb 114->116 116->103 118 7ff73cc430d1-7ff73cc430e8 116->118 123 7ff73cc430ea-7ff73cc430fd 118->123 124 7ff73cc43103-7ff73cc43108 call 7ff73cc474b4 118->124 119->120 121 7ff73cc4326b-7ff73cc432bf call 7ff73cc41290 call 7ff73cc42fa0 120->121 122 7ff73cc43156-7ff73cc4315a 120->122 149 7ff73cc436c1-7ff73cc436c9 121->149 150 7ff73cc432c5-7ff73cc432d3 121->150 126 7ff73cc4315c-7ff73cc4316f 122->126 127 7ff73cc43174-7ff73cc4317e 122->127 123->124 128 7ff73cc4325f-7ff73cc43264 call 7ff73cc4ed2c 123->128 124->103 131 7ff73cc43213-7ff73cc4321c 126->131 132 7ff73cc43190-7ff73cc431b0 127->132 133 7ff73cc43180-7ff73cc4318e 127->133 140 7ff73cc43265-7ff73cc4326a call 7ff73cc411f0 128->140 131->103 137 7ff73cc43222-7ff73cc43239 131->137 139 7ff73cc431b6-7ff73cc431b9 132->139 132->140 138 7ff73cc431bb-7ff73cc431c2 133->138 137->124 143 7ff73cc4323f-7ff73cc43252 137->143 145 7ff73cc431ec-7ff73cc431f1 call 7ff73cc47230 138->145 146 7ff73cc431c4-7ff73cc431cb 138->146 139->138 144 7ff73cc431f4-7ff73cc43212 call 7ff73cc60d40 139->144 140->121 143->128 151 7ff73cc43254 143->151 144->131 145->144 146->140 152 7ff73cc431d1-7ff73cc431dc call 7ff73cc47230 146->152 159 7ff73cc436fd-7ff73cc43723 call 7ff73cc47210 149->159 160 7ff73cc436cb-7ff73cc436e1 149->160 156 7ff73cc432d9-7ff73cc43355 call 7ff73cc45450 call 7ff73cc44f30 call 7ff73cc46000 150->156 157 7ff73cc433e1-7ff73cc43414 URLDownloadToFileW 150->157 151->124 173 7ff73cc43259-7ff73cc4325e call 7ff73cc4ed2c 152->173 174 7ff73cc431de-7ff73cc431ea 152->174 192 7ff73cc43357-7ff73cc4336e 156->192 193 7ff73cc4338e-7ff73cc433a9 156->193 164 7ff73cc4341a-7ff73cc43427 157->164 165 7ff73cc436bf 157->165 167 7ff73cc436f8 call 7ff73cc474b4 160->167 168 7ff73cc436e3-7ff73cc436f6 160->168 171 7ff73cc4342d-7ff73cc43540 call 7ff73cc45450 call 7ff73cc44f30 * 3 call 7ff73cc46000 164->171 172 7ff73cc43681-7ff73cc436b9 ShellExecuteW 164->172 165->149 167->159 168->167 175 7ff73cc43724-7ff73cc43729 call 7ff73cc4ed2c 168->175 212 7ff73cc43579-7ff73cc43594 171->212 213 7ff73cc43542-7ff73cc43559 171->213 172->165 173->128 174->144 185 7ff73cc4372a-7ff73cc4372f call 7ff73cc4ed2c 175->185 196 7ff73cc43730-7ff73cc43735 call 7ff73cc4ed2c 185->196 197 7ff73cc43389 call 7ff73cc474b4 192->197 198 7ff73cc43370-7ff73cc43383 192->198 193->157 195 7ff73cc433ab-7ff73cc433c1 193->195 200 7ff73cc433dc call 7ff73cc474b4 195->200 201 7ff73cc433c3-7ff73cc433d6 195->201 209 7ff73cc43736-7ff73cc4373b call 7ff73cc4ed2c 196->209 197->193 198->185 198->197 200->157 201->196 201->200 219 7ff73cc4373c-7ff73cc43741 call 7ff73cc4ed2c 209->219 217 7ff73cc43596-7ff73cc435ad 212->217 218 7ff73cc435d5-7ff73cc435e7 212->218 215 7ff73cc4355b-7ff73cc4356e 213->215 216 7ff73cc43574 call 7ff73cc474b4 213->216 215->209 215->216 216->212 222 7ff73cc435c8-7ff73cc435cd call 7ff73cc474b4 217->222 223 7ff73cc435af-7ff73cc435c2 217->223 224 7ff73cc435e9-7ff73cc435ff 218->224 225 7ff73cc43627-7ff73cc43638 218->225 233 7ff73cc43742-7ff73cc43747 call 7ff73cc4ed2c 219->233 222->218 223->219 223->222 230 7ff73cc4361a-7ff73cc4361f call 7ff73cc474b4 224->230 231 7ff73cc43601-7ff73cc43614 224->231 227 7ff73cc4363a-7ff73cc43650 225->227 228 7ff73cc43678-7ff73cc4367d 225->228 234 7ff73cc4366b-7ff73cc43670 call 7ff73cc474b4 227->234 235 7ff73cc43652-7ff73cc43665 227->235 228->172 230->225 231->230 231->233 239 7ff73cc43748-7ff73cc43776 call 7ff73cc4ed2c call 7ff73cc455d0 233->239 234->228 235->234 235->239 248 7ff73cc43778-7ff73cc43786 239->248 249 7ff73cc43787-7ff73cc437d7 239->249
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskCreateDirectoryDownloadExecuteFileFolderPathShell
                                                                                                                                                                                                                                                                                              • String ID: with cmd parameters: $Downloading OperaGX from $Installing OperaGX from $\OperaGXInstaller.exe$\Temp\OperaGXInstaller$open
                                                                                                                                                                                                                                                                                              • API String ID: 2003451238-1610449224
                                                                                                                                                                                                                                                                                              • Opcode ID: ca74ba52d865b057e18924c8cabf8dd8ea0352c25a5b159b3b0c79ac3f12a0a7
                                                                                                                                                                                                                                                                                              • Instruction ID: 2936ec57fb9f2955fcbc342c83052fb50f49548b16a83c44febf263e778a9661
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ca74ba52d865b057e18924c8cabf8dd8ea0352c25a5b159b3b0c79ac3f12a0a7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6932D672E18B9191EB01EB24D4413ADA3A2FB84794F949331EA6C17BD9DF7CE580D350
                                                                                                                                                                                                                                                                                              Function 00007FF73CC475CC Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3251591375-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 6c511745e5b27e0e79cb29c46112e52516a354af5d3ec53c60d81737e9fa5be4
                                                                                                                                                                                                                                                                                              • Instruction ID: 0a14b1cf044b365bac4d86ecd51f610d7aebae1fda5fc9c0e3f22c1678a18c5d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6c511745e5b27e0e79cb29c46112e52516a354af5d3ec53c60d81737e9fa5be4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 53316931E08163B2FA16BB65A5522F9A2D3AF41344FC88434EA4D4F6D7CE2CE409E370
                                                                                                                                                                                                                                                                                              Function 00007FF73CC50260 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 82984600d927f14b984d08c084b1c10d78b7c27e025206c23de2d4b0ed23722c
                                                                                                                                                                                                                                                                                              • Instruction ID: 461d46a5963218e4f5d76612f9ab1cb1bcdb47ebf5f8d881bbaa2908928715aa
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 82984600d927f14b984d08c084b1c10d78b7c27e025206c23de2d4b0ed23722c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3FD09EB4B0870662EB543BB15D55079A2916F4B701F881438C90F86393CD3CA45DE220
                                                                                                                                                                                                                                                                                              Function 00007FF73CC50191 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3947729631-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 904e59e9f6960ba59f0717c8faaa9ed4d452668bdb1d8d85410422f2ef2ea1ca
                                                                                                                                                                                                                                                                                              • Instruction ID: cd68d0f9204ebab9d24741fe2bb510896192ecddff26c3737ab9289a472baf5f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 904e59e9f6960ba59f0717c8faaa9ed4d452668bdb1d8d85410422f2ef2ea1ca
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A9218B72E04B469AEB24AFA5C8542BC73E0EB4431CF940639D72D86AD5DF38E484D760
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5A914 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 02e8a339529ba54739c8f73d9323feb57d96edded77de6cf7205bffb5689dee0
                                                                                                                                                                                                                                                                                              • Instruction ID: 84b7e5a1f05b45aa8bba8b0d5f555e987927f11cdcae18accd9362d1e30d1c42
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 02e8a339529ba54739c8f73d9323feb57d96edded77de6cf7205bffb5689dee0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9119AB2908662A6F300BB16A441138F3E1FB80740FC64039E74C577A2CF3CE811AB20
                                                                                                                                                                                                                                                                                              Function 00007FF73CC472A8 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF73CC472BC
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC49228: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF73CC49230
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC49228: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF73CC49235
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1208906642-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 9112dd4d99d341d7a172efdda120adc1e5291804729fb68371748ba3369a7be1
                                                                                                                                                                                                                                                                                              • Instruction ID: 7415771a47d7495e771d0cde3bdcccba30e8cb7de4dc2c8a04c267750c681f79
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9112dd4d99d341d7a172efdda120adc1e5291804729fb68371748ba3369a7be1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 76E0B630D0C273B5FDBA3A6111022F8D6C61F21304ED08579E94D5A1C39D1D7046F631
                                                                                                                                                                                                                                                                                              Function 00007FF73CC55C7C Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,?,00000000,00007FF73CC547FE,?,?,00000001,00007FF73CC4EE81,?,?,?,?,00007FF73CC549B8), ref: 00007FF73CC55CD1
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AllocHeap
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4292702814-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 37f582e182106f89bcd9eeeec982c4c4fa3c04183ec9f3604f220980ccffa08a
                                                                                                                                                                                                                                                                                              • Instruction ID: e19ad68bb180fdb70791e9f4a62ffa56df9c627f98a939ed2562b4909ad81587
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 37f582e182106f89bcd9eeeec982c4c4fa3c04183ec9f3604f220980ccffa08a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 98F049B4F0A61661FE65766399012B4A2C15F9DB80FDC4036CA0E8A2D3DE2CB4816230

                                                                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                                                                              Function 00007FF73CC5EDC8 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 451 7ff73cc5edc8-7ff73cc5ee3b call 7ff73cc5eafc 454 7ff73cc5ee3d-7ff73cc5ee46 call 7ff73cc4ee58 451->454 455 7ff73cc5ee55-7ff73cc5ee5f call 7ff73cc5aacc 451->455 460 7ff73cc5ee49-7ff73cc5ee50 call 7ff73cc4ee78 454->460 461 7ff73cc5ee7a-7ff73cc5eee3 CreateFileW 455->461 462 7ff73cc5ee61-7ff73cc5ee78 call 7ff73cc4ee58 call 7ff73cc4ee78 455->462 474 7ff73cc5f196-7ff73cc5f1b6 460->474 465 7ff73cc5eee5-7ff73cc5eeeb 461->465 466 7ff73cc5ef60-7ff73cc5ef6b GetFileType 461->466 462->460 471 7ff73cc5ef2d-7ff73cc5ef5b GetLastError call 7ff73cc4edec 465->471 472 7ff73cc5eeed-7ff73cc5eef1 465->472 468 7ff73cc5efbe-7ff73cc5efc5 466->468 469 7ff73cc5ef6d-7ff73cc5efa8 GetLastError call 7ff73cc4edec CloseHandle 466->469 477 7ff73cc5efcd-7ff73cc5efd0 468->477 478 7ff73cc5efc7-7ff73cc5efcb 468->478 469->460 485 7ff73cc5efae-7ff73cc5efb9 call 7ff73cc4ee78 469->485 471->460 472->471 479 7ff73cc5eef3-7ff73cc5ef2b CreateFileW 472->479 483 7ff73cc5efd6-7ff73cc5f02b call 7ff73cc5a9e4 477->483 484 7ff73cc5efd2 477->484 478->483 479->466 479->471 489 7ff73cc5f02d-7ff73cc5f039 call 7ff73cc5ed04 483->489 490 7ff73cc5f04a-7ff73cc5f07b call 7ff73cc5e87c 483->490 484->483 485->460 489->490 496 7ff73cc5f03b 489->496 497 7ff73cc5f07d-7ff73cc5f07f 490->497 498 7ff73cc5f081-7ff73cc5f0c3 490->498 499 7ff73cc5f03d-7ff73cc5f045 call 7ff73cc54afc 496->499 497->499 500 7ff73cc5f0e5-7ff73cc5f0f0 498->500 501 7ff73cc5f0c5-7ff73cc5f0c9 498->501 499->474 504 7ff73cc5f194 500->504 505 7ff73cc5f0f6-7ff73cc5f0fa 500->505 501->500 503 7ff73cc5f0cb-7ff73cc5f0e0 501->503 503->500 504->474 505->504 506 7ff73cc5f100-7ff73cc5f145 CloseHandle CreateFileW 505->506 508 7ff73cc5f147-7ff73cc5f175 GetLastError call 7ff73cc4edec call 7ff73cc5ac0c 506->508 509 7ff73cc5f17a-7ff73cc5f18f 506->509 508->509 509->504
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1617910340-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 94085363c7b356bd94df510cab8eb0ed819b029ee1dc399499fce941a39c6ea0
                                                                                                                                                                                                                                                                                              • Instruction ID: 709e5a95cb32cf74f2180a339d2df0a7856eaaf04510af410228791a1dfc3010
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 94085363c7b356bd94df510cab8eb0ed819b029ee1dc399499fce941a39c6ea0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FEC1E276B28A4296EB10EF6AC4806BC77A1F749B98F454239DF1E97394CF39D052D310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5C908 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
                                                                                                                                                                                                                                                                                              • String ID: utf8
                                                                                                                                                                                                                                                                                              • API String ID: 3069159798-905460609
                                                                                                                                                                                                                                                                                              • Opcode ID: 29cb0d874f6bbd0f04096247bdb9b8ae84d2ce582cee77917f4e277160f51924
                                                                                                                                                                                                                                                                                              • Instruction ID: 1734c02d5877322549c609592ed2d87a19b5e098909bdcfdd95c2dcb3c4e40c9
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 29cb0d874f6bbd0f04096247bdb9b8ae84d2ce582cee77917f4e277160f51924
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7A91ACB2A08742A5EB24AB22D4412B9B3E5FF48B80F844131DB5D47785EF3CE959E321
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5D350 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2591520935-0
                                                                                                                                                                                                                                                                                              • Opcode ID: eecb0a4850fae007ea8f7c14fca11fcfcf2f291cc266005186970962e89bd590
                                                                                                                                                                                                                                                                                              • Instruction ID: c0e76513ace17246e311b6c134bae904586177b0680efd3ff8fc922f97471c43
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: eecb0a4850fae007ea8f7c14fca11fcfcf2f291cc266005186970962e89bd590
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1E715CB2B08712A9FB50AB62D9606B8B7E0BF44748F844435CB1E47A95DF3CE855E360
                                                                                                                                                                                                                                                                                              Function 00007FF73CC47E58 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3140674995-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1a8667051dd3a3762a4a436a14058d8c8f39d9fc8b58546ba61421f1fd96f97d
                                                                                                                                                                                                                                                                                              • Instruction ID: 99c7efae3622362007c9c9d6748c99fed83dc11fe466c5596e521d13d8c78ab0
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1a8667051dd3a3762a4a436a14058d8c8f39d9fc8b58546ba61421f1fd96f97d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C315E72608B819AEB60AF60E8403EDB3A5FB84744F88403ADB4E47B95DF38D558C720
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4EA40 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1239891234-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 6c0d4b57e753662ccb7e1db5ef862c6052fb0fac63db35c93b14ec7ec372ae69
                                                                                                                                                                                                                                                                                              • Instruction ID: 2f5a3d8ebd370f0a1b112c7e2f8582592f2dc1f5ffaa5a4268170cf0d104135d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6c0d4b57e753662ccb7e1db5ef862c6052fb0fac63db35c93b14ec7ec372ae69
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6431B532618F81A6DB60DF25E8402AEB3E1FB88794F944136EA8D47B95DF3CC555CB10
                                                                                                                                                                                                                                                                                              Function 00007FF73CC59394 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2227656907-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 6dba7b82d0ac9abe76bbec0559e4259a6eafdb2c58644a307bc57a71e720d02c
                                                                                                                                                                                                                                                                                              • Instruction ID: 19b6c3459e582ae5f36e7adb286886d87b3540b262c16b75606fabd3bd9d54b7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6dba7b82d0ac9abe76bbec0559e4259a6eafdb2c58644a307bc57a71e720d02c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1B1A3B2B1869251EB61EB27A4042B9E3D5EB44BD4FC45171EB4D07AC9DF3CE442E320
                                                                                                                                                                                                                                                                                              Function 00007FF73CC480A4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2933794660-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 184006420721c051083f832b9400cd23ade0261b7bb247ed049bfc97e16b231d
                                                                                                                                                                                                                                                                                              • Instruction ID: c5a10ec522edf897b88cd8c79f50ad3f32c006b0339aa5a5584b33cc424aaf49
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 184006420721c051083f832b9400cd23ade0261b7bb247ed049bfc97e16b231d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C115A32B14F01AAEB00DF60E8492B873E4FB18758F880E35DA2D867A4DF38D164C350
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5CDCC Relevance: 4.7, APIs: 3, Instructions: 167COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1791019856-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a171e85f4a9c2380361e5ced98757507de1e2fdcff184def0a985dea2b0d292b
                                                                                                                                                                                                                                                                                              • Instruction ID: 281ebb844b037b4ea5c6f1e2e3681a2f6cd68d94981598607f9a4103e52f7694
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a171e85f4a9c2380361e5ced98757507de1e2fdcff184def0a985dea2b0d292b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CD61B2B2A08542A6EB34AF12E5402BDB3E0FB48740F848235DB8D936D1DF3DE859D750
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5607C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: InfoLocale
                                                                                                                                                                                                                                                                                              • String ID: GetLocaleInfoEx
                                                                                                                                                                                                                                                                                              • API String ID: 2299586839-2904428671
                                                                                                                                                                                                                                                                                              • Opcode ID: 7053c1ce136b0c925a142934eb309f1f3e929c4d005b605faf68994490746386
                                                                                                                                                                                                                                                                                              • Instruction ID: 031faa00f82d3fb515f5b70c5ceac79b0baaf68a126514a0966218857b1ef1d7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7053c1ce136b0c925a142934eb309f1f3e929c4d005b605faf68994490746386
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99018F71B08B81A9EB00AB56B5000AAF7A0AF84FC0F984035DF4D03B65CE3CD556D350
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5879C Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 15204871-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d223640e59dcbd45c0124ebd27acd004745bfc2aa79354aa94ce4041a4cf883a
                                                                                                                                                                                                                                                                                              • Instruction ID: 94280df35d56b624c02edcd9c00938ba212b732fda5185f470789d38678739dc
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d223640e59dcbd45c0124ebd27acd004745bfc2aa79354aa94ce4041a4cf883a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 94B15BB7A04B888BEB55DF2AC84636C7BE0F784B48F588821DB9D837A4CB39D451D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4F444 Relevance: 1.9, APIs: 1, Instructions: 373COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Info
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1807457897-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 49e3de93245ff0a67d86ca284e20d0da1d87cc65a8c8d403a41825e2f6872f24
                                                                                                                                                                                                                                                                                              • Instruction ID: 91af3ac0b4201df9b4e2f7e83d22637464f7336a1d8d53c13cc67f35f42953d1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 49e3de93245ff0a67d86ca284e20d0da1d87cc65a8c8d403a41825e2f6872f24
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0812BE72A08BD196E752DF3998052FDB3A4FB58748F459235EB8C86692EF38E181D310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5AE68 Relevance: 1.8, APIs: 1, Instructions: 337COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                                                                              • Opcode ID: 41cf87d9e60a6fe20c73098acbe023b3350ae157e6b80ec816520b243acc27cf
                                                                                                                                                                                                                                                                                              • Instruction ID: 07f1c289f05583a28735aee2054a79d188c2b90b54b006cae5358506408d0fb7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 41cf87d9e60a6fe20c73098acbe023b3350ae157e6b80ec816520b243acc27cf
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 34E16072A04B8196E720EB62E4516FEB7A4FB54788F804631DF8D53B96EF38E245D310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5D014 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLastValue$InfoLocale
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 673564084-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1e34fda452273e2bf30923eb161b1f842bf45c80eeacbdc6d38c212c5f17ea8f
                                                                                                                                                                                                                                                                                              • Instruction ID: 20f93f8a6faa12fde77b1a37950e7ae0e1bf6db4f3fa7745fbd318eefeff6c62
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1e34fda452273e2bf30923eb161b1f842bf45c80eeacbdc6d38c212c5f17ea8f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE3171B1A0878296EB24AB22D5513BAB3E1FB84744F848035DB5D83785DF3CE416D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5CC64 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: GetLastError.KERNEL32 ref: 00007FF73CC54633
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: FlsGetValue.KERNEL32 ref: 00007FF73CC54648
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: SetLastError.KERNEL32 ref: 00007FF73CC546D3
                                                                                                                                                                                                                                                                                              • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF73CC5D453,?,00000000,00000092,?,?,00000000,?,00007FF73CC51A61), ref: 00007FF73CC5CD02
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$EnumLocalesSystemValue
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3029459697-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1e0ff927b5b67da28b87366f5c75dca7513890141cedd74e49498d1b48cf1bce
                                                                                                                                                                                                                                                                                              • Instruction ID: ee959940fb18fc6a0c90a0d6f6d710c982950960f0f33d17bc21104a2d7f7cf7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1e0ff927b5b67da28b87366f5c75dca7513890141cedd74e49498d1b48cf1bce
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9311E7B3E086459AEB15AF1AD0402B9BBE0FB94BA0F844135C769433C0CE38E9D5D750
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5D21C Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: GetLastError.KERNEL32 ref: 00007FF73CC54633
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: FlsGetValue.KERNEL32 ref: 00007FF73CC54648
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: SetLastError.KERNEL32 ref: 00007FF73CC546D3
                                                                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,?,?,00007FF73CC5CFC6), ref: 00007FF73CC5D253
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$InfoLocaleValue
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3796814847-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2578a66b4cf069b3d40e190531d8892894a4e997666a795efc08127149f9ba68
                                                                                                                                                                                                                                                                                              • Instruction ID: 576355eff4430a60daa652eca259cf2d972b7d819ad359d2a005636ddae64894
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2578a66b4cf069b3d40e190531d8892894a4e997666a795efc08127149f9ba68
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BA117A72F0875353FB74A723A950A7AA2D1EB40750F944231D76D477C4DE2EDC80A710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5CD34 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: GetLastError.KERNEL32 ref: 00007FF73CC54633
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: FlsGetValue.KERNEL32 ref: 00007FF73CC54648
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54624: SetLastError.KERNEL32 ref: 00007FF73CC546D3
                                                                                                                                                                                                                                                                                              • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF73CC5D40F,?,00000000,00000092,?,?,00000000,?,00007FF73CC51A61), ref: 00007FF73CC5CDB2
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$EnumLocalesSystemValue
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3029459697-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 0acc4f16dce578694928b6702be7adb77d5a4bd2d1b5beb20a798383e438b4ed
                                                                                                                                                                                                                                                                                              • Instruction ID: e49a9c927affd6f1f67876adfee1373086e1e2856ebb7fa444fca00545d065f1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0acc4f16dce578694928b6702be7adb77d5a4bd2d1b5beb20a798383e438b4ed
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 840140B2F0824156E7106F17E4407B9FAE1EB44794F858231D76D472D5CF3C9889E710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC55D2C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF73CC5604B,?,?,?,?,?,?,?,?,00000000,00007FF73CC5C2B4), ref: 00007FF73CC55D7B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: EnumLocalesSystem
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2099609381-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 076320fbe6f9668da569e351404b79fc6959aecd3438072bab270a5f4ed7b167
                                                                                                                                                                                                                                                                                              • Instruction ID: 67f1af7acd659a03cdf27cbae70c48bb2f3dc5c99bf036bda6fe31771ba27737
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 076320fbe6f9668da569e351404b79fc6959aecd3438072bab270a5f4ed7b167
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5FF03172B04A41A7E704EB25F8915A5B3E2FB98780F988035EE5D87365DE3CD451D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC57FE8 Relevance: 1.4, APIs: 1, Instructions: 137COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00007FF73CC5808D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC55C7C: HeapAlloc.KERNEL32(?,?,00000000,00007FF73CC547FE,?,?,00000001,00007FF73CC4EE81,?,?,?,?,00007FF73CC549B8), ref: 00007FF73CC55CD1
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54984: HeapFree.KERNEL32 ref: 00007FF73CC5499A
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC54984: GetLastError.KERNEL32 ref: 00007FF73CC549A4
                                                                                                                                                                                                                                                                                                • Part of subcall function 00007FF73CC5F1EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73CC5F21F
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 916656526-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a06c0a75f9b9c47970dd791448bc70da2d02270cc2b8eee3edeb01df59354e93
                                                                                                                                                                                                                                                                                              • Instruction ID: fd2311e422e8ee6cfd732c40e763577ad8b46a5cc22ed6a0aa13b40d5a368b74
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a06c0a75f9b9c47970dd791448bc70da2d02270cc2b8eee3edeb01df59354e93
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2C41E7B2B0924762FA70BA1769017BAE6D07F84BC0F844135EF4D87786EE3CE401A724
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5A5A4 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: HeapProcess
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 54951025-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 691682616558c019e6c519a23d8b4e3e65d4c251bbe4b969eb32e8d13286ca6d
                                                                                                                                                                                                                                                                                              • Instruction ID: c87d9405f6cb2a10449becc79e5c402a3ed190c16ab453061a3c27c0db5395ab
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 691682616558c019e6c519a23d8b4e3e65d4c251bbe4b969eb32e8d13286ca6d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8DB09230E1BA42D6EB483B116C42214A2E4BF58B10FC84038C04C51321DF2C21BAA720
                                                                                                                                                                                                                                                                                              Function 00007FF73CC518B0 Relevance: .3, Instructions: 309COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4023145424-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 84753930473898cdc32dbde3ba518c146122ed319580941121e698bfec777745
                                                                                                                                                                                                                                                                                              • Instruction ID: a175676048181526b431169c8378a1b95620a3628c54041bfa8a4425061fb800
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 84753930473898cdc32dbde3ba518c146122ed319580941121e698bfec777745
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2AC1F5B6A08682A5EB60AB6394143FAA7E0FF94788F804031DF4D57795EF3EE541D310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5C378 Relevance: .3, Instructions: 271COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$Value_invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1500699246-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 64646dfbe44abccbb74d4c6005107c1c7174fd3565da626349a71f2b7ccfb9cd
                                                                                                                                                                                                                                                                                              • Instruction ID: 7864fa52a8f9dcd316b47b458bca5cd3448063e363d65094ea1bdb0cb6e96706
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 64646dfbe44abccbb74d4c6005107c1c7174fd3565da626349a71f2b7ccfb9cd
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FAB10BB2A0864692E724EF62D4116B9B7E0FB58B88F804131DB4D836C9DF3CE945E760
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4EFC4 Relevance: .2, Instructions: 207COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 5b1fce175c0a45002db4c86043f29f358ffc4a76677ed830e7930d562da24922
                                                                                                                                                                                                                                                                                              • Instruction ID: e151b47732c2a83ce4e2ab3a3058172ad4a809958243dc17cbac937f603c03cb
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b1fce175c0a45002db4c86043f29f358ffc4a76677ed830e7930d562da24922
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5781D6B2A04A5196EB65EF25C4813BDA3E1FB84B98F848636DF5D8B795CF38D042D310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5E87C Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c7dbd58809e1e5548ccce09c736d1e9d8a58b9fa65e5a6eb53ea046ab6931c44
                                                                                                                                                                                                                                                                                              • Instruction ID: 2a46f573aaed73d8f10fb7a908258b05fe94ffbe6d22b33da9c332c6657e57d5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7dbd58809e1e5548ccce09c736d1e9d8a58b9fa65e5a6eb53ea046ab6931c44
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A612CB2F1C69262F764AA3A804037DE6C1BF51770F98463DE72D426C1DE3DE840A724
                                                                                                                                                                                                                                                                                              Function 00007FF73CC509FC Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 4a49f81931e0a9d6f0f57f7e2a271747d9afc2d2b2211f9b823964846b02bec4
                                                                                                                                                                                                                                                                                              • Instruction ID: 66118a272b7dc7ad7ba66710e1ca1e675825121f3739bd5d19bb2c3c51e33492
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4a49f81931e0a9d6f0f57f7e2a271747d9afc2d2b2211f9b823964846b02bec4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0941CFB2714A5595EB04DF2BD9651B9A3E1FB48FC4F899036EE0D87B58DE3CD0429300
                                                                                                                                                                                                                                                                                              Function 00007FF73CC608D0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                                                                              • Opcode ID: 6da207e1e129459221e89c8db6b7428a5e0d047de055af97538a988133674467
                                                                                                                                                                                                                                                                                              • Instruction ID: 628a6a17fc0bbb90adb8317f2cae3e366f7f5a1b32d213a5dd23a93c4242244b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6da207e1e129459221e89c8db6b7428a5e0d047de055af97538a988133674467
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7EF06272B192959EEBA8AF28A843639B7D0E748390F90807AD68D87B14D67C90619F14
                                                                                                                                                                                                                                                                                              Function 00007FF73CC48038 Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                                                                              • Opcode ID: b456e07c26b55bb04c2a02cb088bf1790e3b6cff1d180eadebb8c7fa80832c67
                                                                                                                                                                                                                                                                                              • Instruction ID: 19537e8af4965950eecac2493744fdee86f903858f66a1bc5a3cfd767c366060
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b456e07c26b55bb04c2a02cb088bf1790e3b6cff1d180eadebb8c7fa80832c67
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FCA002B2A6CC52F1E619AB00E954030B3B1FB50711BC85431C00DC5560DF3CA495F330
                                                                                                                                                                                                                                                                                              Function 00007FF73CC49F70 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 514 7ff73cc49f70-7ff73cc49fd8 call 7ff73cc4c330 517 7ff73cc49fde-7ff73cc49fe1 514->517 518 7ff73cc4a439-7ff73cc4a43f call 7ff73cc4fc48 514->518 517->518 519 7ff73cc49fe7-7ff73cc49fed 517->519 521 7ff73cc4a0bc-7ff73cc4a0ce 519->521 522 7ff73cc49ff3-7ff73cc49ff7 519->522 524 7ff73cc4a389-7ff73cc4a38d 521->524 525 7ff73cc4a0d4-7ff73cc4a0d8 521->525 522->521 526 7ff73cc49ffd-7ff73cc4a008 522->526 529 7ff73cc4a3c6-7ff73cc4a3d0 call 7ff73cc494a4 524->529 530 7ff73cc4a38f-7ff73cc4a396 524->530 525->524 527 7ff73cc4a0de-7ff73cc4a0e9 525->527 526->521 528 7ff73cc4a00e-7ff73cc4a013 526->528 527->524 533 7ff73cc4a0ef-7ff73cc4a0f3 527->533 528->521 534 7ff73cc4a019-7ff73cc4a023 call 7ff73cc494a4 528->534 529->518 540 7ff73cc4a3d2-7ff73cc4a3f1 call 7ff73cc47210 529->540 530->518 531 7ff73cc4a39c-7ff73cc4a3c1 call 7ff73cc4a944 530->531 531->529 537 7ff73cc4a2b9-7ff73cc4a2c5 533->537 538 7ff73cc4a0f9-7ff73cc4a134 call 7ff73cc48634 533->538 534->540 548 7ff73cc4a029-7ff73cc4a054 call 7ff73cc494a4 * 2 call 7ff73cc48d8c 534->548 537->529 541 7ff73cc4a2cb-7ff73cc4a2cf 537->541 538->537 552 7ff73cc4a13a-7ff73cc4a143 538->552 545 7ff73cc4a2df-7ff73cc4a2e7 541->545 546 7ff73cc4a2d1-7ff73cc4a2dd call 7ff73cc48d4c 541->546 545->529 551 7ff73cc4a2ed-7ff73cc4a2fa call 7ff73cc48474 545->551 546->545 561 7ff73cc4a300-7ff73cc4a308 546->561 581 7ff73cc4a074-7ff73cc4a07e call 7ff73cc494a4 548->581 582 7ff73cc4a056-7ff73cc4a05a 548->582 551->529 551->561 557 7ff73cc4a147-7ff73cc4a179 552->557 558 7ff73cc4a2ac-7ff73cc4a2b3 557->558 559 7ff73cc4a17f-7ff73cc4a18b 557->559 558->537 558->557 559->558 563 7ff73cc4a191-7ff73cc4a1b0 559->563 564 7ff73cc4a41c-7ff73cc4a438 call 7ff73cc494a4 * 2 call 7ff73cc52b00 561->564 565 7ff73cc4a30e-7ff73cc4a312 561->565 567 7ff73cc4a29c-7ff73cc4a2a1 563->567 568 7ff73cc4a1b6-7ff73cc4a1f3 call 7ff73cc48d60 * 2 563->568 564->518 569 7ff73cc4a314-7ff73cc4a323 call 7ff73cc48d4c 565->569 570 7ff73cc4a325 565->570 567->558 594 7ff73cc4a226-7ff73cc4a229 568->594 577 7ff73cc4a327-7ff73cc4a331 call 7ff73cc4c3c8 569->577 570->577 577->529 592 7ff73cc4a337-7ff73cc4a387 call 7ff73cc48540 call 7ff73cc488d4 577->592 581->521 597 7ff73cc4a080-7ff73cc4a0a0 call 7ff73cc494a4 * 2 call 7ff73cc4c3c8 581->597 582->581 586 7ff73cc4a05c-7ff73cc4a067 582->586 586->581 591 7ff73cc4a069-7ff73cc4a06e 586->591 591->518 591->581 592->529 600 7ff73cc4a22b-7ff73cc4a232 594->600 601 7ff73cc4a1f5-7ff73cc4a21b call 7ff73cc48d60 call 7ff73cc4aea8 594->601 619 7ff73cc4a0b7 597->619 620 7ff73cc4a0a2-7ff73cc4a0ac call 7ff73cc4c4b8 597->620 605 7ff73cc4a2a3 600->605 606 7ff73cc4a234-7ff73cc4a238 600->606 616 7ff73cc4a23d-7ff73cc4a29a call 7ff73cc49dc8 601->616 617 7ff73cc4a21d-7ff73cc4a220 601->617 607 7ff73cc4a2a8 605->607 606->568 607->558 616->607 617->594 619->521 624 7ff73cc4a416-7ff73cc4a41b call 7ff73cc52b00 620->624 625 7ff73cc4a0b2-7ff73cc4a415 call 7ff73cc48fcc call 7ff73cc4b7f8 call 7ff73cc49130 620->625 624->564 625->624
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                                                                              • API String ID: 849930591-393685449
                                                                                                                                                                                                                                                                                              • Opcode ID: 7f69478dea0529bfd9b4324cb655095003d974e6be7532ac381d5159be6383bb
                                                                                                                                                                                                                                                                                              • Instruction ID: 80a231c1940a0b8d151c73f65cd92a4ebb6da27cbc2a927dd20a2253fcad7076
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7f69478dea0529bfd9b4324cb655095003d974e6be7532ac381d5159be6383bb
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5BD1E432A087619AEB21EF65D4413ADB7E2FB44798F809135EE4D5BB96DF38E080D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC55DA8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,00000000,00007FF73CC5646C,?,?,?,?,00007FF73CC4EF59,?,?,?,?,00007FF73CC464F0), ref: 00007FF73CC55F24
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,00000000,00007FF73CC5646C,?,?,?,?,00007FF73CC4EF59,?,?,?,?,00007FF73CC464F0), ref: 00007FF73CC55F30
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                                                                              • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                                                                              • Opcode ID: d5350d53b9a108b540140472d650b0c9a026312306117dff0dbc34de2a3690a5
                                                                                                                                                                                                                                                                                              • Instruction ID: 174da32867afd53830e7ac0958526ea6eff6ad23d8c68045946c27aafb414e36
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d5350d53b9a108b540140472d650b0c9a026312306117dff0dbc34de2a3690a5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5C41E2B1B19A02A1EA16FB17A904175A3D5FF45BA0FC84535DE0D87B95EE3CE406E320
                                                                                                                                                                                                                                                                                              Function 00007FF73CC52B8C Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID: f$p$p
                                                                                                                                                                                                                                                                                              • API String ID: 3215553584-1995029353
                                                                                                                                                                                                                                                                                              • Opcode ID: 6641920877726d9bea4643b1bfca5302312388980c93d8d49edeb829dfc4a32d
                                                                                                                                                                                                                                                                                              • Instruction ID: b6a0d1cdce91c9bc12058d0514e3f4b80c5ee55900e8ecdf9dbcf9ce9d34be6a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6641920877726d9bea4643b1bfca5302312388980c93d8d49edeb829dfc4a32d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9412A0B2A0C653A6FB247A16A05427AF2D1FB80750FC84135E78A466D4DF7DF480EB24
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5DDFC Relevance: 10.8, APIs: 7, Instructions: 290COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3215553584-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d44f5596c4ba95dc4d8facded4c036a8b5628df9c660493fe08ebf61fd34fb9c
                                                                                                                                                                                                                                                                                              • Instruction ID: 91ff4d7949c468ce8fd49fe77e92890da0506303ea6ea29cca8ab98f2bce8240
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d44f5596c4ba95dc4d8facded4c036a8b5628df9c660493fe08ebf61fd34fb9c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBC1F4B2A0C78661E711BB1694002BEFBE5EB81B80FD54139DB4D07392DE7DE846E324
                                                                                                                                                                                                                                                                                              Function 00007FF73CC41EE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
                                                                                                                                                                                                                                                                                              • String ID: bad locale name
                                                                                                                                                                                                                                                                                              • API String ID: 1386471777-1405518554
                                                                                                                                                                                                                                                                                              • Opcode ID: 2127218c12560c6a593282355888297356ddc959b0b3049064d99706c7922f53
                                                                                                                                                                                                                                                                                              • Instruction ID: 0a70117b3b9aab47116d2035131c8589a846cfa367c7ac7f470a28ab10f0f0f1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2127218c12560c6a593282355888297356ddc959b0b3049064d99706c7922f53
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 21518D32B09B519AFB12EBB0D4502BDB3F1AF44748F449134DE4D2AA5ACF38E556E360
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4C89C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF73CC4CAA3,?,?,00000000,00007FF73CC495AA,?,?,?,00007FF73CC491E1), ref: 00007FF73CC4C921
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,00007FF73CC4CAA3,?,?,00000000,00007FF73CC495AA,?,?,?,00007FF73CC491E1), ref: 00007FF73CC4C92F
                                                                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,?,?,00007FF73CC4CAA3,?,?,00000000,00007FF73CC495AA,?,?,?,00007FF73CC491E1), ref: 00007FF73CC4C959
                                                                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(?,?,?,00007FF73CC4CAA3,?,?,00000000,00007FF73CC495AA,?,?,?,00007FF73CC491E1), ref: 00007FF73CC4C9C7
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(?,?,?,00007FF73CC4CAA3,?,?,00000000,00007FF73CC495AA,?,?,?,00007FF73CC491E1), ref: 00007FF73CC4C9D3
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                                                                              • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                                                                              • Opcode ID: c732e0ec9715da7047bc6173c6c5c2fac026f284a7a453fcfaa0c57c7631b079
                                                                                                                                                                                                                                                                                              • Instruction ID: 2a04ae266c622916efac96d172ae201ea4ef0d701fd5465373efabeddb56990f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c732e0ec9715da7047bc6173c6c5c2fac026f284a7a453fcfaa0c57c7631b079
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FF319231A1A652B1EE13BB12A800579B3D5BF54BA0F9D8535DD6E0F7A0DF3CE8519220
                                                                                                                                                                                                                                                                                              Function 00007FF73CC54624 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                                                                              • Opcode ID: f89a4529f5795b3fd24d41464677afc58d781e7ae57f6e46faa7f0c099574269
                                                                                                                                                                                                                                                                                              • Instruction ID: 93aeaae6a6880daaa7607034a33391669d6b1cf0014f9bf4a6ff1d88d6e8a543
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f89a4529f5795b3fd24d41464677afc58d781e7ae57f6e46faa7f0c099574269
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A214FB0A0824362FA58B32755561B9E2D15F847A0F884734DB3D06AD6DE2CE411A221
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5FC98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                                                                              • String ID: CONOUT$
                                                                                                                                                                                                                                                                                              • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                                                                              • Opcode ID: 37c57b41c2f95a989fd5bbea919b5954e264531a707f85b094ea5a5cf759e46e
                                                                                                                                                                                                                                                                                              • Instruction ID: 8da11c7e7f0ec5e391eee9bf037aa835a55de6ad456a9e93d733efba1ff4d86d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 37c57b41c2f95a989fd5bbea919b5954e264531a707f85b094ea5a5cf759e46e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47118E71B18A4196E750AB52E844329F3E0FB88BE4F880234EA5D877A4CF7CD555D750
                                                                                                                                                                                                                                                                                              Function 00007FF73CC41380 Relevance: 9.2, APIs: 6, Instructions: 219COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1944019136-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 67bcc04bdcb9d0cc93d42dfbda1e717b846154baaa78262364647485728717f4
                                                                                                                                                                                                                                                                                              • Instruction ID: 99f99f07d202267b1e0ffdaabc5b9fc6cb4e9c01627c1c1ec285baa21bde88fe
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67bcc04bdcb9d0cc93d42dfbda1e717b846154baaa78262364647485728717f4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C181E632A08B8595EA11AF25E44037DB3A2FB44794F549231EB9C0BB96DF7CE4D0D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC44FC0 Relevance: 9.1, APIs: 6, Instructions: 108COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2081738530-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 85d244743926c6a0e710714a85384050a085abaed90579219a3a2bfc465abd18
                                                                                                                                                                                                                                                                                              • Instruction ID: 45a237f223d9028424f260b30145afae0474f326ab3fc0499cea26443186672d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 85d244743926c6a0e710714a85384050a085abaed90579219a3a2bfc465abd18
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 32419336A08B52D5EA11FF11E444169B3E1FB84F90F889532EA8E0B7AADF3CE441D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC455D0 Relevance: 9.1, APIs: 6, Instructions: 90COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2081738530-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d2351090b1b9ab983dfc81cb76eec63e675dab4309510bb1fe33bdff6399b3b8
                                                                                                                                                                                                                                                                                              • Instruction ID: 05971b46f5ff8c528a19ed4340ce964c144a9732e3d8f50a9c91d83857902f3a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d2351090b1b9ab983dfc81cb76eec63e675dab4309510bb1fe33bdff6399b3b8
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5331A632A08A61A5EA22FF15E4411B9F3F1FB54BD4F984531EA8D0B7AADE3CE441D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4A440 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                                                                              • API String ID: 3523768491-393685449
                                                                                                                                                                                                                                                                                              • Opcode ID: 6f623e556e0c1ecce8777134f02cf5394f74fc74c2a08f68b6c98db116719967
                                                                                                                                                                                                                                                                                              • Instruction ID: b1b081274ad6baa034f110bf42a138da29a0ee10dfb37854f5235a1d7a7ab8df
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6f623e556e0c1ecce8777134f02cf5394f74fc74c2a08f68b6c98db116719967
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2CE103339086A29AE722EF24C4813ACB7E5FB44748F548135DE8D5BA96CF38E481E710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC5479C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00000001,00007FF73CC4EE81,?,?,?,?,00007FF73CC549B8), ref: 00007FF73CC547AB
                                                                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,00000001,00007FF73CC4EE81,?,?,?,?,00007FF73CC549B8), ref: 00007FF73CC547E1
                                                                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,00000001,00007FF73CC4EE81,?,?,?,?,00007FF73CC549B8), ref: 00007FF73CC5480E
                                                                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,00000001,00007FF73CC4EE81,?,?,?,?,00007FF73CC549B8), ref: 00007FF73CC5481F
                                                                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,00000001,00007FF73CC4EE81,?,?,?,?,00007FF73CC549B8), ref: 00007FF73CC54830
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?,?,00000001,00007FF73CC4EE81,?,?,?,?,00007FF73CC549B8), ref: 00007FF73CC5484B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Value$ErrorLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2506987500-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1fb7f002ac008b37256a84c6baf85bd24cde70500c2706079dc73aaade09147f
                                                                                                                                                                                                                                                                                              • Instruction ID: 95468820550da42ad9e395779130883502656780f6edf4fa89dc2c770e9911b0
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1fb7f002ac008b37256a84c6baf85bd24cde70500c2706079dc73aaade09147f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 61114FB0E0824365FA54B7375952079E1D29F447B4F844734DA3E47BD6DE2CA411A620
                                                                                                                                                                                                                                                                                              Function 00007FF73CC502B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                                                                              • Opcode ID: 01deae537eb939b6d87edc1bb862b86760c9dd3ab6f41fc23a89aceb5e2a5f40
                                                                                                                                                                                                                                                                                              • Instruction ID: 3129efbf0cd987afeb2d7eece4132dd88ce619e493ec42059d05d4d5e10553b1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 01deae537eb939b6d87edc1bb862b86760c9dd3ab6f41fc23a89aceb5e2a5f40
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBF062B1A18706A2EB14AB25E584339A3A0EF88B61FDC0635C66E465F5CF3CD054E720
                                                                                                                                                                                                                                                                                              Function 00007FF73CC49840 Relevance: 7.8, APIs: 5, Instructions: 290COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AdjustPointer
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1740715915-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 039e3d15801761ca60f77fea22ea22626a0cd56ad0ed8568843368abe4242061
                                                                                                                                                                                                                                                                                              • Instruction ID: 0df7aff1657ca1f71b0e087bc9488f51fc08636f65b339e7cfe898e8dd3e74d3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 039e3d15801761ca60f77fea22ea22626a0cd56ad0ed8568843368abe4242061
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A0B1D632E0E672A1EA66BF159040239E2EAEF54B84F89C435DE4D0F785DE3CE441E320
                                                                                                                                                                                                                                                                                              Function 00007FF73CC606EC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _set_statfp
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1156100317-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7cd1b476209cf503d31b763a40bca93b285416ea52920da572cf2f75b15e3b04
                                                                                                                                                                                                                                                                                              • Instruction ID: 3250959c411e9175d5395ddb416944a00ba5c419071aa50b13683ab62617ba79
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7cd1b476209cf503d31b763a40bca93b285416ea52920da572cf2f75b15e3b04
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 37110472E48A0735F7143228E612378F8C06F503B0F8C0635EA6E662DB9F5C6891A928
                                                                                                                                                                                                                                                                                              Function 00007FF73CC54864 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FlsGetValue.KERNEL32(?,?,?,00007FF73CC4E9CF,?,?,00000000,00007FF73CC4EC6A,?,?,?,?,00000001,00007FF73CC4EBF6), ref: 00007FF73CC54883
                                                                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF73CC4E9CF,?,?,00000000,00007FF73CC4EC6A,?,?,?,?,00000001,00007FF73CC4EBF6), ref: 00007FF73CC548A2
                                                                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF73CC4E9CF,?,?,00000000,00007FF73CC4EC6A,?,?,?,?,00000001,00007FF73CC4EBF6), ref: 00007FF73CC548CA
                                                                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF73CC4E9CF,?,?,00000000,00007FF73CC4EC6A,?,?,?,?,00000001,00007FF73CC4EBF6), ref: 00007FF73CC548DB
                                                                                                                                                                                                                                                                                              • FlsSetValue.KERNEL32(?,?,?,00007FF73CC4E9CF,?,?,00000000,00007FF73CC4EC6A,?,?,?,?,00000001,00007FF73CC4EBF6), ref: 00007FF73CC548EC
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7ef5486857c9c5e035546231220cbe2bdb682781735e635b26d722b59c234165
                                                                                                                                                                                                                                                                                              • Instruction ID: 4319d589c0bcc0841627ca50ba39fd104761e20a9df1e46daf148164d0e428c1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7ef5486857c9c5e035546231220cbe2bdb682781735e635b26d722b59c234165
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 42114CF0E0C28362FA58F32759421B9E1D59F847B0F884334EA3D467DADE2CB502A225
                                                                                                                                                                                                                                                                                              Function 00007FF73CC546F8 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Value
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3702945584-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 6ba38dd8905678c4523f7f3d4ee5ae48eef2139dab2a74aa6aa1e7164cbc41de
                                                                                                                                                                                                                                                                                              • Instruction ID: c61119349163a75ede5c556dd317888fe3f6d29a7fe14f6d8d545b1558a263df
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6ba38dd8905678c4523f7f3d4ee5ae48eef2139dab2a74aa6aa1e7164cbc41de
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6D11D6F4A082036AFA68B32748521B9D1D15F853B0E984734DB3E0A2D3EE2DB402F675
                                                                                                                                                                                                                                                                                              Function 00007FF73CC579F4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                                                                              • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                                                                              • Opcode ID: d1731be4ce915ec4a9fd67866a1ebd805e3fc303be34a4789763247623d651ad
                                                                                                                                                                                                                                                                                              • Instruction ID: af221901de3628fdff58771a6035f136e80f5417750986084152f22ef9d86d0a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d1731be4ce915ec4a9fd67866a1ebd805e3fc303be34a4789763247623d651ad
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8981A2F2E28603A5FB65BF2BC154278B6E0AB11B44FD58035CB0E57294CB2DF981B761
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4ABB4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                                                                              • Opcode ID: bf42274833c9cc23d207481520b96e12acc23ddb58c140e3b483661af2059945
                                                                                                                                                                                                                                                                                              • Instruction ID: b144b852697a6d1ca84344f923dae857cfdee47afe1677e76272e8f35ffb96c2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bf42274833c9cc23d207481520b96e12acc23ddb58c140e3b483661af2059945
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3791E373A08BA19AE751EB64D4402ACBBF1FB04788F508139EE8C5B755CF38D195D700
                                                                                                                                                                                                                                                                                              Function 00007FF73CC419A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 175COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
                                                                                                                                                                                                                                                                                              • String ID: bad locale name
                                                                                                                                                                                                                                                                                              • API String ID: 2775327233-1405518554
                                                                                                                                                                                                                                                                                              • Opcode ID: 2ec11013f1ee34bdd8eff52547607bf3868de39f4d01d343e30b5d0c980c6a90
                                                                                                                                                                                                                                                                                              • Instruction ID: 282481c898aedca5ede88f033f0ae4703eb4b1f7ba0677163910fc90d68b972f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2ec11013f1ee34bdd8eff52547607bf3868de39f4d01d343e30b5d0c980c6a90
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0971AD32B09B5199EB11EBA1E4503ADB3F2EF44788F448135DE8D2BA59DF38D456E310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC49244 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                                                                              • API String ID: 2395640692-1018135373
                                                                                                                                                                                                                                                                                              • Opcode ID: 6a19ad2cfc46192c4f80e7d8e36424f3a57615769179068c54271530ac62d79d
                                                                                                                                                                                                                                                                                              • Instruction ID: ae2ef48b02660651b610342d9fffb060170f8316ae5c98b1692e077dc903c39a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6a19ad2cfc46192c4f80e7d8e36424f3a57615769179068c54271530ac62d79d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DA519D32B1D622AADB15EB15D044A7CF3EAEB45B98F948130DA5A4B788DF3CE841D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4B134 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                                                                                                              • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                                                                              • Opcode ID: fcba7b1e60297a6ca7aa1700cf1dfd3c14b890a9d7536ba86cdaaac81eebd78a
                                                                                                                                                                                                                                                                                              • Instruction ID: 871acfbdddc6acbddaa6cee8626835e302aa3718988905a005e1d530754a68e1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fcba7b1e60297a6ca7aa1700cf1dfd3c14b890a9d7536ba86cdaaac81eebd78a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CA51DE32A08AA2E6EB75AF12905426CF7E2FB54B94F948131DA8C4BB95CF3CE450D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4A944 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                                                                              • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                                                                              • Opcode ID: a28ec6f54cc873b431bbf4c076a0b4f1498beb36bbbf071ba9fd27947e9b3f5c
                                                                                                                                                                                                                                                                                              • Instruction ID: 4ef286ce8f95a40d0d250dc5919907eab7b6260718c8eadff21521f8a53f5232
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a28ec6f54cc873b431bbf4c076a0b4f1498beb36bbbf071ba9fd27947e9b3f5c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C61A132908BD591E772AB15E4413AAF7E1FB94B94F448225EB9C0BB99DF3CD190CB10
                                                                                                                                                                                                                                                                                              Function 00007FF73CC535E4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2718003287-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2fe57fa99c2a35639a6ea3fa2acfcb8d83e21a240fee9d058a46e16b4af87284
                                                                                                                                                                                                                                                                                              • Instruction ID: 32ccbee1f17a4258fc3f89cda901f8d5605cf14f1759bbb8312201fd498a51ea
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2fe57fa99c2a35639a6ea3fa2acfcb8d83e21a240fee9d058a46e16b4af87284
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B3D124B2B18A8099E711DFA6D4402BCB7B1FB54798F884236DF5D97B99CE38D406D320
                                                                                                                                                                                                                                                                                              Function 00007FF73CC53FA4 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73CC53F8F), ref: 00007FF73CC540C0
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73CC53F8F), ref: 00007FF73CC5414B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 953036326-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 023bd68bf874d9190b2ed59238311647a28cb81b4e815dedc98f12f2f2417ff2
                                                                                                                                                                                                                                                                                              • Instruction ID: 3f15c7e6695510db64ac101dfba69ac5d66b7dff5f31f0bc27195afdff42eaf0
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 023bd68bf874d9190b2ed59238311647a28cb81b4e815dedc98f12f2f2417ff2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DC91B5B2F08651A5F750EB6798402FDABE0BB55788F944139DF0E57685CF38D482E720
                                                                                                                                                                                                                                                                                              Function 00007FF73CC414E0 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_task__std_exception_copy__std_exception_destroy_invalid_parameter_noinfo_noreturn
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3942279934-0
                                                                                                                                                                                                                                                                                              • Opcode ID: ba2826c6e7adf5d7e6d974a3e78a36ab89faa94ebe6c57dfe98ab76399dae354
                                                                                                                                                                                                                                                                                              • Instruction ID: 6ea90e70f01552af75f67e6f00742091ffac4eae27a24a99affcd6a23a841b03
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ba2826c6e7adf5d7e6d974a3e78a36ab89faa94ebe6c57dfe98ab76399dae354
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E751FA32A09B96A1EA11AB15E5403B9A3E2EF44794F549231EADD0BBD5DF3CE080D310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4B36C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __except_validate_context_record
                                                                                                                                                                                                                                                                                              • String ID: csm$csm
                                                                                                                                                                                                                                                                                              • API String ID: 1467352782-3733052814
                                                                                                                                                                                                                                                                                              • Opcode ID: 67029988ddd01ebd3a78416f03b8ec12f0aae4ea8c914e2898f4bc04249aef44
                                                                                                                                                                                                                                                                                              • Instruction ID: 8be5fb1c13bdc4796b6dbf0d48b1f3eed78521bad5361383896248e50bad0abf
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67029988ddd01ebd3a78416f03b8ec12f0aae4ea8c914e2898f4bc04249aef44
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A571B272508AA296D762AF25D0A077DFBE2EB04B98F94C136DE4C4BA85CF3CD491D710
                                                                                                                                                                                                                                                                                              Function 00007FF73CC4BA04 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateFrameInfo__except_validate_context_record
                                                                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                                                                              • API String ID: 2558813199-1018135373
                                                                                                                                                                                                                                                                                              • Opcode ID: 88f239882cf04c7d0f81e6632002978b9a701930c19b8ed8f601a6fb9fd81763
                                                                                                                                                                                                                                                                                              • Instruction ID: d90ebca12628889b91e3607eefc5e7a4ec2ddd883fa1044fc4c90f0c85c2faac
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 88f239882cf04c7d0f81e6632002978b9a701930c19b8ed8f601a6fb9fd81763
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C3515F32A18B6196E621EB15E14026DF7F9FB88BA0F505135DF8D0BB56CF38E451DB10
                                                                                                                                                                                                                                                                                              Function 00007FF73CC505AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe, xrefs: 00007FF73CC505EA
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                                                                                                              • String ID: C:\Users\user\Desktop\SecuriteInfo.com.Adware.Elemental.22.22509.21519.exe
                                                                                                                                                                                                                                                                                              • API String ID: 3580290477-2293841793
                                                                                                                                                                                                                                                                                              • Opcode ID: d7064e5203b7ec23a8d5f2136e0455283c5eefaeeeee97f072366843368a6818
                                                                                                                                                                                                                                                                                              • Instruction ID: d7a2537e7291ac9edd5a7231a91628663ee513d39b225f297b172f5c72989e0c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d7064e5203b7ec23a8d5f2136e0455283c5eefaeeeee97f072366843368a6818
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F4162B6A08B12A9EB14FF2694410BCF7D4EF84794F954035EA4E47786DE3DE441A720
                                                                                                                                                                                                                                                                                              Function 00007FF73CC45450 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
                                                                                                                                                                                                                                                                                              • String ID: ios_base::badbit set
                                                                                                                                                                                                                                                                                              • API String ID: 73155330-3882152299
                                                                                                                                                                                                                                                                                              • Opcode ID: 6478f19b2646d189e5acb4541f15f1a478e0bc12be70720e9d31a3752ef141c5
                                                                                                                                                                                                                                                                                              • Instruction ID: bb09b0c7238b062934bd8964b63a0aad239c014bc52841485cfa83b45542b59c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6478f19b2646d189e5acb4541f15f1a478e0bc12be70720e9d31a3752ef141c5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BB311372F05AA5A1DA11FB51A004179B2E6AB04BF4F948731EE7D4BBDADE38E441D310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC45810 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
                                                                                                                                                                                                                                                                                              • String ID: ios_base::failbit set
                                                                                                                                                                                                                                                                                              • API String ID: 73155330-3924258884
                                                                                                                                                                                                                                                                                              • Opcode ID: 3bb154721650e6df162b12e5203a89a50ea0663d3c2b228b92bc7ac32d289b8b
                                                                                                                                                                                                                                                                                              • Instruction ID: 276101337d9ce0b9bee4c2b6f0f226dd89edb833c344d0708a41181c194c60b4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3bb154721650e6df162b12e5203a89a50ea0663d3c2b228b92bc7ac32d289b8b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E731F631B09791A5EE15BB12A504368F2D3AB14BE4F988631DE5D0F7C6DE3CE042E320
                                                                                                                                                                                                                                                                                              Function 00007FF73CC53C7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                                                                              • String ID: U
                                                                                                                                                                                                                                                                                              • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                                                                              • Opcode ID: 4692d602bab4c68b89d33db351f1542d48bf0214a7b74cbf2408536dce727e25
                                                                                                                                                                                                                                                                                              • Instruction ID: 75648c1a3ea379a35ba1872f805983cac1d02b7ade075aab3c667241a606d121
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4692d602bab4c68b89d33db351f1542d48bf0214a7b74cbf2408536dce727e25
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2241A272B28A4196EB20AF26E4443BAA7A1FB98784F884131EF4D87798DF3CD441D750
                                                                                                                                                                                                                                                                                              Function 00007FF73CC42500 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
                                                                                                                                                                                                                                                                                              • String ID: ios_base::failbit set
                                                                                                                                                                                                                                                                                              • API String ID: 1109970293-3924258884
                                                                                                                                                                                                                                                                                              • Opcode ID: 5a941ef3c09cbbe378f7a5f066cbd833c0ce3a9a4c12537773dd76907a7db9b4
                                                                                                                                                                                                                                                                                              • Instruction ID: 5d32a8493e5660a0b28e7b9c860abb9ace5efad3210f81435304fc117f9c4f28
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a941ef3c09cbbe378f7a5f066cbd833c0ce3a9a4c12537773dd76907a7db9b4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FB21D372E18B8591EA019B24E5411B9F3A1EB997A4F94E331EAAC06795EF3CE1D0C310
                                                                                                                                                                                                                                                                                              Function 00007FF73CC49130 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF73CC4120F), ref: 00007FF73CC49180
                                                                                                                                                                                                                                                                                              • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF73CC4120F), ref: 00007FF73CC491C1
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                                                                              • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                                                                              • Opcode ID: c45e2879d6f14941efa81951a7084c2996607d07d12531ee5b97f045f733f837
                                                                                                                                                                                                                                                                                              • Instruction ID: 041169008ffa4ccf725bee683364c5cfff3006b198667237f76965ffd2961365
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c45e2879d6f14941efa81951a7084c2996607d07d12531ee5b97f045f733f837
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7C112B32618B9192EB219B15E54426AB7E5FB88B84F988231EF8D4BB58DF3CD551CB00
                                                                                                                                                                                                                                                                                              Function 00007FF73CC41290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000000.00000002.2263292780.00007FF73CC41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73CC40000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263236410.00007FF73CC40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263364502.00007FF73CC63000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263421617.00007FF73CC73000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000000.00000002.2263478316.00007FF73CC76000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff73cc40000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Xinvalid_argument__std_exception_copystd::_
                                                                                                                                                                                                                                                                                              • String ID: string too long
                                                                                                                                                                                                                                                                                              • API String ID: 2536225881-2556327735
                                                                                                                                                                                                                                                                                              • Opcode ID: 8d1f826d4177bd9769294b57c3a8920dc26e93aede754971a102bbde98faa91e
                                                                                                                                                                                                                                                                                              • Instruction ID: 55064db982ae88ce51914ac6f5f70d6aa6c8cb88605766047c037421125e763f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8d1f826d4177bd9769294b57c3a8920dc26e93aede754971a102bbde98faa91e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0FE06D72E14B04A0DB06AF61E8900B8B3A1AB68B10BC8C132D95C4B355EE2CE1E5D320

                                                                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                                                                              Execution Coverage:12.8%
                                                                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                                              Signature Coverage:6%
                                                                                                                                                                                                                                                                                              Total number of Nodes:1911
                                                                                                                                                                                                                                                                                              Total number of Limit Nodes:24
                                                                                                                                                                                                                                                                                              execution_graph 31873 d065c3 31874 d065dd 31873->31874 31875 d065cb CloseHandle 31873->31875 31875->31874 31876 d065a6 GetLastError 31875->31876 31878 d09844 31881 d09827 SetFileTime 31878->31881 31880 d09851 31882 d09840 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 31881->31882 31882->31880 31883 d35015 31888 d34daa 31883->31888 31886 d35054 31894 d34dd8 ___vcrt_FlsFree 31888->31894 31889 d34f28 31893 d34f33 31889->31893 31906 d2b5b9 14 API calls __dosmaperr 31889->31906 31891 d35003 31907 d269c7 39 API calls __Getctype 31891->31907 31893->31886 31900 d375e8 31893->31900 31894->31889 31903 d36aa6 40 API calls 2 library calls 31894->31903 31896 d34f90 31896->31889 31904 d36aa6 40 API calls 2 library calls 31896->31904 31898 d34fae 31898->31889 31905 d36aa6 40 API calls 2 library calls 31898->31905 31908 d36cd4 31900->31908 31903->31896 31904->31898 31905->31889 31906->31891 31907->31893 31910 d36ce0 ___scrt_is_nonwritable_in_current_image 31908->31910 31909 d36ce7 31966 d2b5b9 14 API calls __dosmaperr 31909->31966 31910->31909 31912 d36d12 31910->31912 31919 d372be 31912->31919 31913 d36cec 31967 d269c7 39 API calls __Getctype 31913->31967 31918 d36cf6 31918->31886 31969 d3709a 31919->31969 31922 d372f0 32001 d2b5a6 14 API calls __dosmaperr 31922->32001 31923 d37309 31987 d316e2 31923->31987 31927 d37317 32003 d2b5a6 14 API calls __dosmaperr 31927->32003 31928 d3732e 32000 d37005 CreateFileW 31928->32000 31932 d3731c 32004 d2b5b9 14 API calls __dosmaperr 31932->32004 31933 d36d36 31968 d36d69 LeaveCriticalSection __wsopen_s 31933->31968 31935 d373e4 GetFileType 31936 d37436 31935->31936 31937 d373ef GetLastError 31935->31937 32009 d3162d 15 API calls 2 library calls 31936->32009 32007 d2b55f 14 API calls __dosmaperr 31937->32007 31938 d372f5 32002 d2b5b9 14 API calls __dosmaperr 31938->32002 31939 d373b9 GetLastError 32006 d2b55f 14 API calls __dosmaperr 31939->32006 31941 d37367 31941->31935 31941->31939 32005 d37005 CreateFileW 31941->32005 31943 d373fd CloseHandle 31943->31938 31945 d37426 31943->31945 32008 d2b5b9 14 API calls __dosmaperr 31945->32008 31947 d373ac 31947->31935 31947->31939 31949 d37457 31951 d374a3 31949->31951 32010 d37214 73 API calls 3 library calls 31949->32010 31950 d3742b 31950->31938 31955 d374aa 31951->31955 32012 d36daf 73 API calls 4 library calls 31951->32012 31954 d374d8 31954->31955 31956 d374e6 31954->31956 32011 d2fa35 42 API calls 2 library calls 31955->32011 31956->31933 31958 d37562 CloseHandle 31956->31958 32013 d37005 CreateFileW 31958->32013 31960 d3758d 31961 d37597 GetLastError 31960->31961 31962 d375c3 31960->31962 32014 d2b55f 14 API calls __dosmaperr 31961->32014 31962->31933 31964 d375a3 32015 d317f5 15 API calls 2 library calls 31964->32015 31966->31913 31967->31918 31968->31918 31970 d370d5 31969->31970 31971 d370bb 31969->31971 32016 d3702a 31970->32016 31971->31970 32023 d2b5b9 14 API calls __dosmaperr 31971->32023 31974 d3710d 31977 d3713c 31974->31977 32025 d2b5b9 14 API calls __dosmaperr 31974->32025 31975 d370ca 32024 d269c7 39 API calls __Getctype 31975->32024 31985 d3718f 31977->31985 32027 d29166 39 API calls 2 library calls 31977->32027 31980 d3718a 31982 d37207 31980->31982 31980->31985 31981 d37131 32026 d269c7 39 API calls __Getctype 31981->32026 32028 d269f4 11 API calls CallUnexpected 31982->32028 31985->31922 31985->31923 31986 d37213 31988 d316ee ___scrt_is_nonwritable_in_current_image 31987->31988 32031 d2aac4 EnterCriticalSection 31988->32031 31990 d3171a 32035 d314bc 15 API calls 3 library calls 31990->32035 31991 d316f5 31991->31990 31995 d31789 EnterCriticalSection 31991->31995 31997 d3173c 31991->31997 31995->31997 31998 d31796 LeaveCriticalSection 31995->31998 31996 d3171f 31996->31997 32036 d3160a EnterCriticalSection 31996->32036 32032 d317ec 31997->32032 31998->31991 32000->31941 32001->31938 32002->31933 32003->31932 32004->31938 32005->31947 32006->31938 32007->31943 32008->31950 32009->31949 32010->31951 32011->31933 32012->31954 32013->31960 32014->31964 32015->31962 32018 d37042 32016->32018 32017 d3705d 32017->31974 32018->32017 32029 d2b5b9 14 API calls __dosmaperr 32018->32029 32020 d37081 32030 d269c7 39 API calls __Getctype 32020->32030 32022 d3708c 32022->31974 32023->31975 32024->31970 32025->31981 32026->31977 32027->31980 32028->31986 32029->32020 32030->32022 32031->31991 32037 d2ab0c LeaveCriticalSection 32032->32037 32034 d3175c 32034->31927 32034->31928 32035->31996 32036->31997 32037->32034 32038 d21244 32039 d21250 ___scrt_is_nonwritable_in_current_image 32038->32039 32066 d20fa4 32039->32066 32041 d21257 32042 d213aa 32041->32042 32048 d21281 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock CallUnexpected 32041->32048 32221 d2162a 4 API calls 2 library calls 32042->32221 32044 d213b1 32214 d28697 32044->32214 32050 d212a0 32048->32050 32051 d21321 32048->32051 32217 d28148 39 API calls 4 library calls 32048->32217 32049 d213bf 32074 d2173f 32051->32074 32058 d2133c 32218 d21775 GetModuleHandleW 32058->32218 32060 d21343 32060->32044 32061 d21347 32060->32061 32062 d21350 32061->32062 32219 d2864c 21 API calls CallUnexpected 32061->32219 32220 d21115 75 API calls ___scrt_uninitialize_crt 32062->32220 32065 d21358 32065->32050 32067 d20fad 32066->32067 32223 d2144a IsProcessorFeaturePresent 32067->32223 32069 d20fb9 32224 d24edb 10 API calls 2 library calls 32069->32224 32071 d20fbe 32073 d20fc2 32071->32073 32225 d24efa 7 API calls 2 library calls 32071->32225 32073->32041 32226 d23660 32074->32226 32076 d21752 GetStartupInfoW 32077 d21327 32076->32077 32078 d290ba 32077->32078 32227 d30970 32078->32227 32080 d2132f 32083 d1ee57 32080->32083 32082 d290c3 32082->32080 32233 d30c20 39 API calls 32082->32233 32236 d1df9d GetVersionExW 32083->32236 32090 d070e4 41 API calls 32091 d1eea5 32090->32091 32092 d070e4 41 API calls 32091->32092 32093 d1eeb1 32092->32093 32094 d070e4 41 API calls 32093->32094 32095 d1eebd GetCommandLineW 32094->32095 32252 d07108 32095->32252 32097 d1eecd 32256 d067ec 32097->32256 32099 d1eee2 32100 d070e4 41 API calls 32099->32100 32101 d1eef7 32100->32101 32262 d080d2 32101->32262 32103 d1ef36 32270 d06dd7 32103->32270 32105 d1ef03 32105->32103 32404 d071a5 32105->32404 32106 d1ef4b 32273 d1e84b 32106->32273 32109 d1ef67 32110 d070e4 41 API calls 32109->32110 32131 d1ee77 32109->32131 32111 d1ef8c 32110->32111 32112 d070e4 41 API calls 32111->32112 32113 d1ef95 32112->32113 32282 d077ee 32113->32282 32115 d1efac 32115->32131 32291 d07a12 32115->32291 32118 d07a12 41 API calls 32119 d1efef 32118->32119 32120 d07a12 41 API calls 32119->32120 32125 d1f001 32120->32125 32121 d1f055 32122 d07a12 41 API calls 32121->32122 32123 d1f067 32122->32123 32298 d07204 32123->32298 32125->32121 32127 d1f041 MessageBoxW 32125->32127 32126 d1f071 32128 d07a12 41 API calls 32126->32128 32127->32121 32127->32131 32129 d1f08c 32128->32129 32130 d07204 41 API calls 32129->32130 32132 d1f099 32130->32132 32131->32058 32133 d07a12 41 API calls 32132->32133 32134 d1f0b4 32133->32134 32135 d07204 41 API calls 32134->32135 32136 d1f0c1 32135->32136 32137 d07a12 41 API calls 32136->32137 32138 d1f0dc 32137->32138 32139 d07204 41 API calls 32138->32139 32140 d1f0e6 32139->32140 32302 d1eafd 32140->32302 32142 d1f0f8 32142->32131 32322 d1de90 32142->32322 32144 d1f167 32145 d1f1ae 32144->32145 32325 d08a77 32144->32325 32343 d20cd9 32145->32343 32148 d1f181 32150 d1f185 32148->32150 32151 d07204 41 API calls 32148->32151 32149 d1f1b5 32359 d16898 32149->32359 32401 d1deaa 32150->32401 32151->32145 32154 d1f1d3 32155 d070e4 41 API calls 32154->32155 32162 d1f1d7 32154->32162 32156 d1f1f6 32155->32156 32367 d19f5b 32156->32367 32159 d1f217 32160 d1f221 32159->32160 32161 d1f2b2 32159->32161 32160->32162 32166 d1f233 32160->32166 32408 d0a3de 43 API calls 32160->32408 32394 d1def0 32161->32394 32411 d0b92d 32162->32411 32165 d1f2c7 32400 d087b9 SetCurrentDirectoryW 32165->32400 32166->32162 32168 d1f26e 32166->32168 32409 d1de7b 43 API calls 32166->32409 32410 d0a2bf 43 API calls __EH_prolog3_GS 32168->32410 32171 d1df1d 44 API calls 32171->32162 32172 d1f264 32173 d07204 41 API calls 32172->32173 32173->32168 32174 d1f2d7 32175 d1f2fe 32174->32175 32179 d1f417 32174->32179 32210 d1f424 32174->32210 32178 d0717a 41 API calls 32175->32178 32176 d1f283 32177 d1f296 MessageBoxW 32176->32177 32177->32162 32183 d1f30d 32178->32183 32180 d07108 41 API calls 32179->32180 32179->32210 32181 d1f439 32180->32181 32182 d0758c 41 API calls 32181->32182 32184 d1f44c 32182->32184 32185 d1f36d 32183->32185 32186 d0739a 41 API calls 32183->32186 32187 d0717a 41 API calls 32184->32187 32192 d0717a 41 API calls 32185->32192 32188 d1f35c 32186->32188 32189 d1f463 32187->32189 32190 d073e4 41 API calls 32188->32190 32191 d1ebdb 104 API calls 32189->32191 32190->32185 32194 d1f478 32191->32194 32193 d1f383 32192->32193 32198 d1f390 32193->32198 32195 d1f49c 32194->32195 32196 d07392 41 API calls 32194->32196 32202 d0717a 41 API calls 32195->32202 32199 d1f48e 32196->32199 32197 d1f3aa ShellExecuteExW 32200 d1f3fe 32197->32200 32205 d1f3d9 32197->32205 32198->32197 32201 d073e4 41 API calls 32199->32201 32204 d1f54d 32200->32204 32201->32195 32203 d1f4e9 32202->32203 32206 d1f507 CreateProcessW 32203->32206 32209 d1f556 WaitForSingleObject GetExitCodeProcess CloseHandle 32204->32209 32204->32210 32205->32210 32207 d1f513 32206->32207 32208 d1f536 CloseHandle 32206->32208 32207->32210 32212 d1ea71 45 API calls 32207->32212 32208->32200 32211 d1f580 32209->32211 32210->32171 32213 d1feb6 Sleep QueryPerformanceCounter QueryPerformanceFrequency 32211->32213 32212->32210 32213->32210 34087 d284cb 32214->34087 32217->32051 32218->32060 32219->32062 32220->32065 32221->32044 32222 d2865b 21 API calls CallUnexpected 32222->32049 32223->32069 32224->32071 32225->32073 32226->32076 32228 d309ab 32227->32228 32229 d30979 32227->32229 32228->32082 32234 d2c7d7 39 API calls 3 library calls 32229->32234 32231 d3099c 32235 d3077b 49 API calls 4 library calls 32231->32235 32233->32082 32234->32231 32235->32228 32237 d1dfcb 32236->32237 32417 d20b18 32237->32417 32239 d1dfe4 32239->32131 32240 d01c57 GetVersion 32239->32240 32241 d01ca0 GetSystemDirectoryW 32240->32241 32242 d01c76 GetModuleHandleW GetProcAddress 32240->32242 32243 d01d39 32241->32243 32247 d01cba 32241->32247 32242->32241 32244 d01c91 32242->32244 32245 d20b18 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 32243->32245 32244->32241 32244->32243 32246 d01d46 32245->32246 32249 d070e4 32246->32249 32247->32243 32248 d01d08 LoadLibraryExW 32247->32248 32248->32243 32248->32247 32425 d20c5c 32249->32425 32251 d070f1 32251->32090 32253 d07117 32252->32253 32491 d06ef5 32253->32491 32255 d07121 32255->32097 32260 d067ff 32256->32260 32257 d06852 32257->32099 32258 d06854 32261 d071a5 41 API calls 32258->32261 32260->32257 32260->32258 32494 d0679a 32260->32494 32261->32257 32499 d0677c 32262->32499 32264 d080ed GetModuleFileNameW 32265 d08127 32264->32265 32266 d08115 32264->32266 32268 d20b18 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 32265->32268 32266->32265 32267 d071a5 41 API calls 32266->32267 32267->32265 32269 d08138 32268->32269 32269->32105 32271 d20c5c 41 API calls 32270->32271 32272 d06de4 32271->32272 32272->32106 32274 d1e866 __wsopen_s 32273->32274 32500 d0971d 32274->32500 32276 d1e8a5 std::_Locinfo::_Locinfo_ctor ctype 32277 d1ea1e 32276->32277 32503 d0977b 32276->32503 32507 d06b81 41 API calls 32276->32507 32278 d20b18 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 32277->32278 32280 d1ea54 32278->32280 32280->32109 32290 d077fa __EH_prolog3 32282->32290 32285 d07cf3 41 API calls 32285->32290 32286 d07970 std::locale::locale 32286->32115 32287 d06dd7 41 API calls 32287->32290 32288 d06b81 41 API calls 32288->32290 32290->32285 32290->32286 32290->32287 32290->32288 32526 d07994 41 API calls 2 library calls 32290->32526 32527 d07726 41 API calls 2 library calls 32290->32527 32528 d07a7f 41 API calls 32290->32528 32292 d07a2a 32291->32292 32293 d07a37 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 32292->32293 32294 d07a2e 32292->32294 32529 d0717a 32293->32529 32295 d070e4 41 API calls 32294->32295 32296 d07a35 32295->32296 32296->32118 32299 d07212 32298->32299 32301 d07238 32298->32301 32300 d20c5c 41 API calls 32299->32300 32299->32301 32300->32301 32301->32126 32303 d1eb09 __EH_prolog3 32302->32303 32304 d070e4 41 API calls 32303->32304 32321 d1eb14 std::locale::locale 32303->32321 32305 d1eb28 32304->32305 32532 d087c7 32305->32532 32307 d1eb35 32308 d07108 41 API calls 32307->32308 32309 d1eb4a 32308->32309 32548 d0758c 32309->32548 32311 d1eb5d 32552 d0813a 42 API calls 2 library calls 32311->32552 32313 d1eb70 32314 d07204 41 API calls 32313->32314 32315 d1eb7d 32314->32315 32316 d07108 41 API calls 32315->32316 32317 d1eb9d 32316->32317 32318 d0758c 41 API calls 32317->32318 32319 d1ebb0 32318->32319 32553 d08421 32319->32553 32321->32142 32323 d070e4 41 API calls 32322->32323 32324 d1dea5 32323->32324 32324->32144 32326 d08a83 __EH_prolog3 32325->32326 32578 d08b1b 32326->32578 32328 d08a8a 32329 d070e4 41 API calls 32328->32329 32342 d08afc std::locale::locale 32328->32342 32330 d08aa4 32329->32330 32583 d088de GetTempPathW 32330->32583 32334 d08ac2 32335 d06dd7 41 API calls 32334->32335 32336 d08aca 32335->32336 32592 d08946 32336->32592 32338 d08ae2 32339 d07204 41 API calls 32338->32339 32338->32342 32340 d08af1 32339->32340 32626 d082c4 32340->32626 32342->32148 32346 d20cde 32343->32346 32344 d26367 _Yarn 15 API calls 32344->32346 32345 d20cf8 32345->32149 32346->32344 32346->32345 32347 d281ae std::_Facet_Register 2 API calls 32346->32347 32348 d20cfa 32346->32348 32347->32346 32349 d1a1f7 std::_Facet_Register 32348->32349 32351 d20d04 std::_Facet_Register 32348->32351 32350 d24f11 Concurrency::cancel_current_task RaiseException 32349->32350 32352 d1a213 32350->32352 32353 d24f11 Concurrency::cancel_current_task RaiseException 32351->32353 32354 d1a22f std::bad_exception::bad_exception 40 API calls 32352->32354 32355 d21449 32353->32355 32356 d1a222 32354->32356 32356->32149 32357 d20cd9 std::_Facet_Register 41 API calls 32356->32357 32358 d1a250 32357->32358 32358->32149 32365 d168a4 __EH_prolog3 32359->32365 32361 d1696d std::locale::locale 32361->32154 32362 d070e4 41 API calls 32362->32365 32364 d07320 41 API calls 32364->32365 32365->32361 32365->32362 32365->32364 32840 d1672d 32365->32840 32843 d167bf 32365->32843 32853 d169c5 41 API calls 32365->32853 32368 d19f6a __EH_prolog3 32367->32368 32885 d1a0bc 32368->32885 32370 d19f7f 32371 d07204 41 API calls 32370->32371 32372 d19f95 32371->32372 32373 d07204 41 API calls 32372->32373 32374 d19fa3 32373->32374 32375 d20cd9 std::_Facet_Register 41 API calls 32374->32375 32376 d19fad 32375->32376 32895 d1a13b 32376->32895 32378 d19fbc 32379 d1a062 32378->32379 32380 d19fdc 32378->32380 32909 d19d32 32379->32909 32949 d134f5 32380->32949 32382 d07204 41 API calls 32386 d1a079 32382->32386 32385 d070e4 41 API calls 32387 d1a02d 32385->32387 32388 d1a00f 32386->32388 32389 d07204 41 API calls 32386->32389 32952 d19c6e 45 API calls 32387->32952 32943 d1a10c 32388->32943 32389->32388 32392 d1a0b2 std::locale::locale 32392->32159 32393 d1a04c 32393->32382 32395 d1defc __EH_prolog3 32394->32395 32396 d070e4 41 API calls 32395->32396 32397 d1df06 32396->32397 32398 d087c7 43 API calls 32397->32398 32399 d1df15 std::locale::locale 32398->32399 32399->32165 32402 d08b1b 63 API calls 32401->32402 32403 d1ded5 32402->32403 32403->32131 32405 d071b5 32404->32405 32406 d20c5c 41 API calls 32405->32406 32407 d071d7 32405->32407 32406->32407 32407->32103 32408->32166 32409->32172 32410->32176 32412 d0b955 32411->32412 32413 d0b95b 32411->32413 34044 d0a8b2 32412->34044 34048 d136f0 32412->34048 34051 d151f0 32412->34051 32413->32150 32418 d20b20 32417->32418 32419 d20b21 IsProcessorFeaturePresent 32417->32419 32418->32239 32421 d20d69 32419->32421 32424 d20d2c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 32421->32424 32423 d20e4c 32423->32239 32424->32423 32427 d20cd9 32425->32427 32428 d20cf8 32427->32428 32430 d20cfa 32427->32430 32447 d281ae 32427->32447 32450 d26367 32427->32450 32428->32251 32431 d1a1f7 std::_Facet_Register 32430->32431 32433 d20d04 std::_Facet_Register 32430->32433 32441 d24f11 32431->32441 32435 d24f11 Concurrency::cancel_current_task RaiseException 32433->32435 32434 d1a213 32444 d1a22f 32434->32444 32437 d21449 32435->32437 32439 d20cd9 std::_Facet_Register 41 API calls 32440 d1a250 32439->32440 32440->32251 32442 d24f58 RaiseException 32441->32442 32443 d24f2b 32441->32443 32442->32434 32443->32442 32457 d1d83e 32444->32457 32479 d281da 32447->32479 32455 d2c333 __dosmaperr 32450->32455 32451 d2c371 32490 d2b5b9 14 API calls __dosmaperr 32451->32490 32452 d2c35c RtlAllocateHeap 32454 d2c36f 32452->32454 32452->32455 32454->32427 32455->32451 32455->32452 32456 d281ae std::_Facet_Register 2 API calls 32455->32456 32456->32455 32460 d24e59 32457->32460 32461 d24e66 32460->32461 32467 d1a222 32460->32467 32462 d26367 _Yarn 15 API calls 32461->32462 32461->32467 32463 d24e83 32462->32463 32464 d24e93 32463->32464 32468 d2bbaf 39 API calls 2 library calls 32463->32468 32469 d2634c 32464->32469 32467->32251 32467->32439 32468->32464 32472 d2c2f9 32469->32472 32473 d26364 32472->32473 32474 d2c304 RtlFreeHeap 32472->32474 32473->32467 32474->32473 32475 d2c319 GetLastError 32474->32475 32476 d2c326 __dosmaperr 32475->32476 32478 d2b5b9 14 API calls __dosmaperr 32476->32478 32478->32473 32480 d281e6 ___scrt_is_nonwritable_in_current_image 32479->32480 32485 d2aac4 EnterCriticalSection 32480->32485 32482 d281f1 CallUnexpected 32486 d28228 32482->32486 32485->32482 32489 d2ab0c LeaveCriticalSection 32486->32489 32488 d281b9 32488->32427 32489->32488 32490->32454 32492 d20c5c 41 API calls 32491->32492 32493 d06f19 32492->32493 32493->32255 32495 d067a8 32494->32495 32496 d067ad 32494->32496 32498 d06f28 41 API calls Concurrency::cancel_current_task 32495->32498 32496->32260 32498->32496 32499->32264 32508 d0970a 32500->32508 32505 d09796 32503->32505 32506 d097c7 32505->32506 32524 d0972d ReadFile 32505->32524 32506->32276 32507->32276 32511 d096af 32508->32511 32516 d0948b 32511->32516 32514 d09702 32514->32276 32515 d096ea SetFileTime 32515->32514 32521 d094c0 32516->32521 32519 d0949a CreateFileW 32520 d094bb 32519->32520 32520->32514 32520->32515 32522 d094ea CloseHandle 32521->32522 32523 d09496 32521->32523 32522->32523 32523->32519 32523->32520 32525 d09750 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 32524->32525 32525->32505 32526->32290 32527->32290 32528->32290 32530 d06ef5 41 API calls 32529->32530 32531 d0718c 32530->32531 32531->32296 32533 d087d6 __EH_prolog3_GS 32532->32533 32534 d087dd GetCurrentDirectoryW 32533->32534 32535 d08804 32534->32535 32547 d08820 32534->32547 32536 d08824 32535->32536 32537 d0880c 32535->32537 32540 d070e4 41 API calls 32536->32540 32539 d071a5 41 API calls 32537->32539 32539->32547 32541 d0882f 32540->32541 32572 d076d8 41 API calls 32541->32572 32542 d08894 32542->32307 32544 d0883f GetCurrentDirectoryW 32545 d08849 32544->32545 32544->32547 32546 d07204 41 API calls 32545->32546 32545->32547 32546->32547 32569 d390f4 32547->32569 32549 d0759c 32548->32549 32550 d075ff 32549->32550 32573 d07548 41 API calls 32549->32573 32550->32311 32552->32313 32554 d0842d __EH_prolog3 32553->32554 32574 d08f5c GetFileAttributesW 32554->32574 32556 d08434 32557 d07108 41 API calls 32556->32557 32561 d0843d std::locale::locale 32556->32561 32560 d08469 32557->32560 32558 d08495 32559 d0717a 41 API calls 32558->32559 32565 d084a9 32559->32565 32560->32558 32560->32561 32561->32321 32563 d084b8 GetLastError 32564 d08573 32563->32564 32563->32565 32564->32561 32565->32563 32565->32564 32567 d0851c 32565->32567 32575 d08399 57 API calls 2 library calls 32565->32575 32567->32564 32576 d07267 41 API calls 32567->32576 32577 d0838a CreateDirectoryW 32567->32577 32570 d20b18 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 32569->32570 32571 d390fe 32570->32571 32571->32571 32572->32544 32573->32549 32574->32556 32575->32565 32576->32567 32577->32567 32579 d08b23 32578->32579 32580 d08b27 32578->32580 32579->32328 32630 d085c6 32580->32630 32582 d08b2f 32582->32328 32584 d071a5 41 API calls 32583->32584 32585 d08922 32584->32585 32586 d20b18 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 32585->32586 32587 d08944 32586->32587 32587->32342 32588 d073a8 32587->32588 32589 d073b7 32588->32589 32590 d06f6f 41 API calls 32589->32590 32591 d073c1 32590->32591 32591->32334 32811 d39136 32592->32811 32594 d08952 GetCurrentThreadId GetTickCount GetCurrentProcessId 32608 d0897f 32594->32608 32595 d08a71 32823 d20e4e 32595->32823 32598 d089be GetTickCount 32599 d07108 41 API calls 32598->32599 32599->32608 32600 d08a76 __EH_prolog3 32602 d08b1b 63 API calls 32600->32602 32601 d082c4 41 API calls 32601->32608 32604 d08a8a 32602->32604 32606 d070e4 41 API calls 32604->32606 32622 d08afc std::locale::locale 32604->32622 32605 d08a01 SetLastError 32605->32608 32607 d08aa4 32606->32607 32609 d088de 42 API calls 32607->32609 32608->32595 32608->32601 32608->32605 32612 d08a21 GetLastError 32608->32612 32614 d08a49 32608->32614 32812 d06df9 32608->32812 32816 d093c0 32608->32816 32822 d0838a CreateDirectoryW 32608->32822 32611 d08ab1 32609->32611 32613 d073a8 41 API calls 32611->32613 32611->32622 32612->32608 32615 d08ac2 32613->32615 32618 d390f4 5 API calls 32614->32618 32616 d06dd7 41 API calls 32615->32616 32617 d08aca 32616->32617 32620 d08946 66 API calls 32617->32620 32619 d08a61 32618->32619 32619->32338 32621 d08ae2 32620->32621 32621->32622 32623 d07204 41 API calls 32621->32623 32622->32338 32624 d08af1 32623->32624 32625 d082c4 41 API calls 32624->32625 32625->32622 32627 d082d1 32626->32627 32628 d0741c 41 API calls 32627->32628 32629 d082d9 32628->32629 32629->32342 32631 d085d2 __EH_prolog3 32630->32631 32663 d083fd 32631->32663 32633 d085df 32667 d08f6e 32633->32667 32635 d085f5 32636 d08605 SetLastError 32635->32636 32637 d08610 std::locale::locale 32635->32637 32638 d08620 32635->32638 32636->32637 32637->32582 32639 d0717a 41 API calls 32638->32639 32654 d08727 32638->32654 32640 d08644 32639->32640 32725 d07d4f 32640->32725 32643 d08653 32728 d0876a 32643->32728 32645 d0874f 32645->32637 32752 d0837d RemoveDirectoryW 32645->32752 32646 d08666 32732 d093f7 32646->32732 32650 d083fd 41 API calls 32651 d0867e 32650->32651 32737 d09443 32651->32737 32653 d08690 32653->32654 32656 d085c6 59 API calls 32653->32656 32657 d086c8 GetLastError 32653->32657 32659 d09443 44 API calls 32653->32659 32660 d086e2 GetLastError 32653->32660 32661 d086fc 32653->32661 32741 d073e4 32653->32741 32744 d0858f 32653->32744 32751 d0836f SetFileAttributesW 32654->32751 32656->32653 32657->32653 32659->32653 32660->32653 32661->32654 32662 d08703 SetLastError 32661->32662 32662->32637 32664 d0840c 32663->32664 32665 d070e4 41 API calls 32664->32665 32666 d08414 32665->32666 32666->32633 32668 d08f7a __EH_prolog3 32667->32668 32669 d07108 41 API calls 32668->32669 32672 d0912d 32668->32672 32670 d08fb2 32669->32670 32671 d07108 41 API calls 32670->32671 32678 d08fc0 32671->32678 32673 d091bc 32672->32673 32674 d09173 32672->32674 32676 d091da 32673->32676 32682 d091df 32673->32682 32684 d0920d 32673->32684 32771 d08f5c GetFileAttributesW 32674->32771 32773 d08f5c GetFileAttributesW 32676->32773 32677 d0917a 32677->32682 32683 d0918e 32677->32683 32689 d08ffe 32678->32689 32762 d0741c 32678->32762 32685 d090c8 std::locale::locale 32682->32685 32753 d08d20 32682->32753 32686 d071a5 41 API calls 32683->32686 32684->32682 32774 d09353 8 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 32684->32774 32685->32635 32688 d091a6 32686->32688 32687 d092cf 32687->32685 32779 d09353 8 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 32687->32779 32772 d09353 8 API calls __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 32688->32772 32690 d09046 32689->32690 32701 d09024 32689->32701 32692 d08f6e 54 API calls 32690->32692 32696 d09051 32692->32696 32694 d09245 32697 d09257 32694->32697 32698 d09249 32694->32698 32696->32672 32699 d09044 32696->32699 32702 d07108 41 API calls 32697->32702 32700 d071a5 41 API calls 32698->32700 32766 d08c03 41 API calls 2 library calls 32699->32766 32700->32685 32701->32699 32708 d07204 41 API calls 32701->32708 32704 d09260 32702->32704 32706 d07d4f 41 API calls 32704->32706 32705 d09073 32767 d0933a 41 API calls 32705->32767 32709 d0926c 32706->32709 32708->32699 32775 d08b4a 32709->32775 32711 d09275 32714 d08d20 43 API calls 32711->32714 32713 d090fd SetLastError 32713->32685 32717 d09287 32714->32717 32719 d092f1 32717->32719 32778 d08f5c GetFileAttributesW 32717->32778 32718 d092a7 32718->32682 32718->32719 32720 d071a5 41 API calls 32719->32720 32720->32685 32721 d0907f 32721->32685 32721->32713 32722 d090ca 32721->32722 32768 d08b54 CharUpperW 32721->32768 32769 d0933a 41 API calls 32721->32769 32770 d08f0b 48 API calls 32721->32770 32724 d073e4 41 API calls 32722->32724 32724->32685 32726 d0679a 41 API calls 32725->32726 32727 d07d56 32726->32727 32727->32643 32729 d08776 __EH_prolog3 32728->32729 32730 d070e4 41 API calls 32729->32730 32731 d0878c std::locale::locale 32730->32731 32731->32646 32733 d07204 41 API calls 32732->32733 32734 d09408 32733->32734 32735 d08b4a 41 API calls 32734->32735 32736 d08676 32735->32736 32736->32650 32740 d0944f 32737->32740 32739 d09469 32739->32653 32740->32739 32795 d09415 32740->32795 32742 d06f6f 41 API calls 32741->32742 32743 d073f6 32742->32743 32743->32653 32809 d08f5c GetFileAttributesW 32744->32809 32746 d08597 32747 d085b8 DeleteFileW 32746->32747 32810 d0836f SetFileAttributesW 32746->32810 32747->32653 32749 d085b2 32749->32747 32750 d085b6 32749->32750 32750->32653 32751->32645 32752->32637 32780 d08d01 32753->32780 32756 d08d6c 32759 d20b18 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 32756->32759 32757 d08d4e FindFirstFileW 32757->32756 32758 d08d61 32757->32758 32783 d08ca9 41 API calls 32758->32783 32761 d08d83 32759->32761 32761->32687 32763 d0742e 32762->32763 32784 d06f6f 32763->32784 32766->32705 32767->32721 32768->32721 32769->32721 32770->32721 32771->32677 32772->32685 32773->32682 32774->32694 32776 d0679a 41 API calls 32775->32776 32777 d08b51 32776->32777 32777->32711 32778->32718 32779->32685 32781 d08d09 FindClose 32780->32781 32782 d08d15 32780->32782 32781->32782 32782->32756 32782->32757 32783->32756 32785 d06fbc 32784->32785 32787 d06f86 32784->32787 32785->32689 32786 d06fc3 32789 d24f11 Concurrency::cancel_current_task RaiseException 32786->32789 32787->32786 32788 d06fb1 32787->32788 32792 d06e4e 32788->32792 32791 d06fd8 32789->32791 32793 d20c5c 41 API calls 32792->32793 32794 d06e70 32793->32794 32794->32785 32796 d09420 32795->32796 32797 d09427 32796->32797 32799 d0942e 32796->32799 32802 d08d89 FindNextFileW 32797->32802 32801 d08d20 43 API calls 32799->32801 32800 d0942c 32800->32740 32801->32800 32803 d08db3 32802->32803 32804 d08db7 32802->32804 32806 d20b18 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 32803->32806 32808 d08ca9 41 API calls 32804->32808 32807 d08dd1 32806->32807 32807->32800 32808->32803 32809->32746 32810->32749 32811->32594 32813 d06e08 32812->32813 32826 d06d70 32813->32826 32815 d06e12 32815->32598 32817 d093cc __EH_prolog3 32816->32817 32818 d083fd 41 API calls 32817->32818 32819 d093d6 32818->32819 32820 d08f6e 55 API calls 32819->32820 32821 d093e5 std::locale::locale 32820->32821 32821->32608 32822->32608 32835 d20e5a IsProcessorFeaturePresent 32823->32835 32827 d06dba 32826->32827 32829 d06d87 32826->32829 32827->32815 32828 d06dc1 32831 d24f11 Concurrency::cancel_current_task RaiseException 32828->32831 32829->32828 32830 d06db2 32829->32830 32834 d06cf0 41 API calls ctype 32830->32834 32833 d06dd6 32831->32833 32834->32827 32836 d20e6f 32835->32836 32839 d20d2c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 32836->32839 32838 d20e58 32838->32600 32839->32838 32841 d070e4 41 API calls 32840->32841 32842 d1674c 32841->32842 32842->32365 32844 d167cb __EH_prolog3 32843->32844 32854 d07636 32844->32854 32846 d167f1 32847 d07636 41 API calls 32846->32847 32851 d167fc Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 32847->32851 32849 d16880 std::locale::locale 32849->32365 32851->32849 32852 d07204 41 API calls 32851->32852 32863 d07994 41 API calls 2 library calls 32851->32863 32864 d07a7f 41 API calls 32851->32864 32852->32851 32853->32365 32855 d07642 __EH_prolog3 32854->32855 32856 d070e4 41 API calls 32855->32856 32857 d076c0 std::locale::locale 32855->32857 32861 d07665 32856->32861 32857->32846 32858 d076aa 32858->32857 32865 d068cc 32858->32865 32859 d0679a 41 API calls 32859->32861 32861->32858 32861->32859 32862 d068cc 41 API calls 32861->32862 32862->32861 32863->32851 32864->32851 32870 d06974 32865->32870 32869 d068e1 32869->32857 32871 d06981 32870->32871 32872 d068d7 32870->32872 32873 d069a2 32871->32873 32874 d0698a 32871->32874 32878 d0691c 32872->32878 32876 d24f11 Concurrency::cancel_current_task RaiseException 32873->32876 32884 d069d0 41 API calls ctype 32874->32884 32877 d069b7 32876->32877 32879 d06928 __EH_prolog3 32878->32879 32880 d20cd9 std::_Facet_Register 41 API calls 32879->32880 32881 d06931 32880->32881 32882 d0717a 41 API calls 32881->32882 32883 d06943 std::locale::locale 32882->32883 32883->32869 32884->32872 32886 d1a0c8 __EH_prolog3 32885->32886 32887 d070e4 41 API calls 32886->32887 32888 d1a0d5 32887->32888 32889 d070e4 41 API calls 32888->32889 32890 d1a0e1 32889->32890 32953 d19935 32890->32953 32892 d1a0f5 32893 d070e4 41 API calls 32892->32893 32894 d1a104 std::locale::locale 32893->32894 32894->32370 32896 d1a147 __EH_prolog3 32895->32896 32897 d070e4 41 API calls 32896->32897 32898 d1a175 32897->32898 32899 d070e4 41 API calls 32898->32899 32900 d1a181 32899->32900 32901 d070e4 41 API calls 32900->32901 32902 d1a18d 32901->32902 32903 d070e4 41 API calls 32902->32903 32904 d1a1a1 32903->32904 32965 d19a8a 32904->32965 32906 d1a1ad 32907 d070e4 41 API calls 32906->32907 32908 d1a1bc std::locale::locale 32907->32908 32908->32378 32910 d19d41 __EH_prolog3 32909->32910 32911 d083fd 41 API calls 32910->32911 32912 d19d4e 32911->32912 32913 d08f6e 55 API calls 32912->32913 32914 d19d6a 32913->32914 32915 d19d6e 32914->32915 32917 d19d8d 32914->32917 33065 d07320 32915->33065 32980 d16f0d 32917->32980 32920 d07204 41 API calls 32921 d19dcd 32920->32921 32984 d18643 32921->32984 32923 d19de9 32924 d19df3 32923->32924 32925 d19e08 32923->32925 32927 d07320 41 API calls 32924->32927 32926 d0717a 41 API calls 32925->32926 32929 d19e14 32926->32929 32928 d19d7e std::locale::locale 32927->32928 32928->32393 32930 d08421 59 API calls 32929->32930 32931 d19e2f 32930->32931 32932 d19e36 32931->32932 32933 d19e5e 32931->32933 33069 d18c3a 43 API calls 2 library calls 32932->33069 33008 d0713a 32933->33008 32936 d19e6b 33012 d192f3 32936->33012 32937 d19e3f 32938 d07204 41 API calls 32937->32938 32938->32928 32940 d19e8e 33018 d0c23a 32940->33018 33062 d0c7d5 32940->33062 32944 d1a11a 32943->32944 33868 d19982 15 API calls Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 32944->33868 33869 d0661c 32949->33869 32952->32393 32954 d19941 __EH_prolog3 32953->32954 32955 d070e4 41 API calls 32954->32955 32956 d1996e 32955->32956 32959 d16f57 32956->32959 32958 d1997a std::locale::locale 32958->32892 32960 d16f63 __EH_prolog3 32959->32960 32961 d070e4 41 API calls 32960->32961 32962 d16f84 32961->32962 32963 d070e4 41 API calls 32962->32963 32964 d16f8f std::locale::locale 32963->32964 32964->32958 32966 d19a96 __EH_prolog3 32965->32966 32967 d070e4 41 API calls 32966->32967 32968 d19ab6 32967->32968 32978 d19a58 InitializeCriticalSection 32968->32978 32970 d19ad2 32979 d199c0 GetLastError CreateEventW 32970->32979 32972 d19ae6 32973 d19aea std::locale::locale 32972->32973 32974 d24f11 Concurrency::cancel_current_task RaiseException 32972->32974 32973->32906 32975 d19b07 32974->32975 32976 d07204 41 API calls 32975->32976 32977 d19b19 32976->32977 32977->32906 32978->32970 32979->32972 32981 d16f23 32980->32981 32982 d070e4 41 API calls 32981->32982 32983 d16f40 32982->32983 32983->32920 32985 d1864f __EH_prolog3 32984->32985 32986 d20cd9 std::_Facet_Register 41 API calls 32985->32986 32987 d18664 32986->32987 33070 d16cb7 32987->33070 32989 d18672 32990 d070e4 41 API calls 32989->32990 32991 d18692 32990->32991 32992 d070e4 41 API calls 32991->32992 32993 d1869e 32992->32993 32994 d186df 32993->32994 32995 d186af 32993->32995 33166 d15b24 41 API calls 32994->33166 33078 d08895 32995->33078 32998 d186c5 33084 d15a9e 32998->33084 33000 d186d4 33002 d186da 33000->33002 33094 d18087 33000->33094 33003 d0b92d 15 API calls 33002->33003 33004 d18799 std::locale::locale 33003->33004 33004->32923 33006 d068cc 41 API calls 33007 d1870a Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33006->33007 33007->33002 33007->33006 33167 d070a2 33007->33167 33009 d0714c 33008->33009 33010 d06ef5 41 API calls 33009->33010 33011 d07156 33010->33011 33011->32936 33013 d19304 33012->33013 33014 d07204 41 API calls 33013->33014 33015 d19316 33014->33015 33016 d07204 41 API calls 33015->33016 33017 d1933e 33016->33017 33017->32940 33022 d0c27e 33018->33022 33019 d0b92d 15 API calls 33020 d0c7aa 33019->33020 33020->32928 33021 d20cd9 std::_Facet_Register 41 API calls 33023 d0c391 33021->33023 33022->33021 33061 d0c383 33022->33061 33024 d20cd9 std::_Facet_Register 41 API calls 33023->33024 33042 d0c3ea 33024->33042 33025 d0c444 33027 d0b92d 15 API calls 33025->33027 33026 d0c477 33028 d0b92d 15 API calls 33026->33028 33029 d0c44c 33027->33029 33030 d0c47f 33028->33030 33031 d0b92d 15 API calls 33029->33031 33032 d0b92d 15 API calls 33030->33032 33033 d0c454 33031->33033 33034 d0c487 33032->33034 33035 d0c7d5 15 API calls 33033->33035 33036 d0c7d5 15 API calls 33034->33036 33037 d0c45f 33035->33037 33039 d0c492 33036->33039 33040 d0b92d 15 API calls 33037->33040 33041 d0b92d 15 API calls 33039->33041 33040->33061 33041->33061 33042->33025 33042->33026 33043 d0c5e2 33042->33043 33052 d0c705 33042->33052 33055 d0c208 69 API calls 33042->33055 33432 d0bed4 33042->33432 33435 d0afe5 33042->33435 33044 d0b92d 15 API calls 33043->33044 33045 d0c5ea 33044->33045 33046 d0b92d 15 API calls 33045->33046 33047 d0c5f2 33046->33047 33048 d0c7d5 15 API calls 33047->33048 33049 d0c5fd 33048->33049 33050 d0b92d 15 API calls 33049->33050 33050->33061 33053 d0b92d 15 API calls 33052->33053 33054 d0c70d 33053->33054 33056 d0b92d 15 API calls 33054->33056 33055->33042 33057 d0c715 33056->33057 33058 d0c7d5 15 API calls 33057->33058 33059 d0c720 33058->33059 33060 d0b92d 15 API calls 33059->33060 33060->33061 33061->33019 33063 d0b92d 15 API calls 33062->33063 33064 d0c7e0 33063->33064 33066 d07332 33065->33066 33067 d20c5c 41 API calls 33066->33067 33068 d07350 33066->33068 33067->33068 33068->32928 33069->32937 33071 d16cc3 __EH_prolog3 33070->33071 33072 d070e4 41 API calls 33071->33072 33073 d16d1d 33072->33073 33074 d070e4 41 API calls 33073->33074 33075 d16d29 33074->33075 33076 d083fd 41 API calls 33075->33076 33077 d16d35 std::locale::locale 33076->33077 33077->32989 33079 d088a4 33078->33079 33080 d071a5 41 API calls 33079->33080 33081 d088b2 33079->33081 33080->33081 33082 d071a5 41 API calls 33081->33082 33083 d088cd 33082->33083 33083->32998 33085 d15aaa __EH_prolog3 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33084->33085 33086 d07204 41 API calls 33085->33086 33087 d15ae0 33086->33087 33088 d070a2 41 API calls 33087->33088 33089 d15aee 33088->33089 33171 d08beb 33089->33171 33091 d15b01 33093 d15b18 std::locale::locale 33091->33093 33174 d09474 GetLastError 33091->33174 33093->33000 33095 d18096 __EH_prolog3 33094->33095 33175 d1805e 33095->33175 33097 d180b0 std::locale::locale 33097->33007 33099 d07204 41 API calls 33102 d180a0 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33099->33102 33101 d184ec 33103 d18517 33101->33103 33268 d17b31 41 API calls 33101->33268 33102->33097 33102->33099 33102->33101 33113 d181e5 33102->33113 33179 d16fa0 33102->33179 33191 d17dc5 33102->33191 33220 d1880c 41 API calls 33102->33220 33221 d185ed 15 API calls 33102->33221 33269 d185ed 15 API calls 33103->33269 33108 d18508 33110 d07204 41 API calls 33108->33110 33109 d185ba 33111 d0a167 VariantClear 33109->33111 33110->33103 33111->33097 33112 d185ca 33114 d0a167 VariantClear 33112->33114 33113->33109 33113->33112 33115 d18261 33113->33115 33114->33097 33115->33112 33116 d1826d 33115->33116 33222 d0a167 33116->33222 33118 d185b0 33119 d0b92d 15 API calls 33118->33119 33119->33097 33120 d185a8 33121 d0b92d 15 API calls 33120->33121 33121->33118 33122 d185a0 33123 d0b92d 15 API calls 33122->33123 33123->33120 33124 d18272 33124->33118 33124->33120 33124->33122 33125 d16fa0 41 API calls 33124->33125 33126 d18338 33125->33126 33226 d17216 43 API calls 2 library calls 33126->33226 33129 d18351 33148 d18529 33129->33148 33227 d17040 VariantClear 33129->33227 33135 d183d2 33138 d16f0d 41 API calls 33135->33138 33139 d183ef 33138->33139 33140 d07204 41 API calls 33139->33140 33141 d18442 33140->33141 33228 d17b8f 33141->33228 33143 d18466 33146 d18561 33143->33146 33147 d1847f 33143->33147 33144 d0b92d 15 API calls 33144->33135 33145 d18371 33145->33135 33145->33144 33145->33148 33271 d17b31 41 API calls 33146->33271 33147->33148 33265 d17401 VariantClear VariantClear 33147->33265 33270 d185ed 15 API calls 33148->33270 33151 d18573 33152 d07204 41 API calls 33151->33152 33156 d18582 33152->33156 33153 d18499 33153->33148 33154 d184a3 33153->33154 33266 d1880c 41 API calls 33154->33266 33272 d185ed 15 API calls 33156->33272 33158 d184b2 33267 d185ed 15 API calls 33158->33267 33166->33000 33168 d070b7 33167->33168 33429 d0705e 33168->33429 33170 d070da 33170->33007 33172 d08f6e 55 API calls 33171->33172 33173 d08bf8 33172->33173 33173->33091 33174->33093 33176 d18069 33175->33176 33177 d18085 33176->33177 33273 d187f0 15 API calls 33176->33273 33177->33102 33180 d16fac __EH_prolog3 33179->33180 33181 d070e4 41 API calls 33180->33181 33182 d16fe9 33181->33182 33183 d070e4 41 API calls 33182->33183 33184 d16ff5 33183->33184 33185 d070e4 41 API calls 33184->33185 33186 d17001 33185->33186 33187 d16f57 41 API calls 33186->33187 33188 d17015 33187->33188 33189 d16f57 41 API calls 33188->33189 33190 d17024 std::locale::locale 33189->33190 33190->33102 33192 d17dd1 __EH_prolog3 33191->33192 33193 d17e22 33192->33193 33194 d17dfa 33192->33194 33196 d20cd9 std::_Facet_Register 41 API calls 33193->33196 33206 d17e01 33193->33206 33195 d20cd9 std::_Facet_Register 41 API calls 33194->33195 33195->33206 33199 d17e2e 33196->33199 33197 d17b8f 97 API calls 33208 d17ea6 33197->33208 33198 d0b92d 15 API calls 33200 d17e7a 33198->33200 33202 d07204 41 API calls 33199->33202 33201 d0b92d 15 API calls 33200->33201 33203 d17e82 std::locale::locale 33201->33203 33204 d17e54 33202->33204 33203->33102 33205 d17e69 33204->33205 33204->33206 33274 d09474 GetLastError 33205->33274 33206->33197 33219 d17e6e 33208->33219 33275 d165ec 41 API calls 33208->33275 33210 d0717a 41 API calls 33217 d17f0b Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33210->33217 33213 d073e4 41 API calls 33213->33217 33214 d0741c 41 API calls 33214->33217 33215 d16d48 55 API calls 33215->33217 33216 d07204 41 API calls 33216->33217 33217->33210 33217->33213 33217->33214 33217->33215 33217->33216 33218 d17b8f 97 API calls 33217->33218 33217->33219 33276 d0738a 41 API calls 33217->33276 33277 d16dd2 41 API calls 33217->33277 33218->33217 33219->33198 33220->33102 33223 d0a184 VariantClear 33222->33223 33224 d0a16f 33222->33224 33225 d0a18b 33223->33225 33224->33223 33224->33225 33225->33124 33226->33129 33227->33145 33229 d17b9b __EH_prolog3 33228->33229 33278 d17730 33229->33278 33231 d17d5b std::locale::locale 33231->33143 33232 d17ba8 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33232->33231 33308 d170ad VariantClear 33232->33308 33234 d17c21 33234->33231 33309 d170ad VariantClear 33234->33309 33236 d17c3e 33236->33231 33310 d170ad VariantClear 33236->33310 33238 d17c5b 33238->33231 33311 d170ad VariantClear 33238->33311 33240 d17c78 33240->33231 33312 d170ad VariantClear 33240->33312 33242 d17c95 33242->33231 33313 d170ad VariantClear 33242->33313 33244 d17cb2 33244->33231 33314 d07e29 33244->33314 33247 d070e4 41 API calls 33248 d17cd1 33247->33248 33249 d071a5 41 API calls 33248->33249 33250 d17cf4 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33248->33250 33249->33250 33250->33231 33251 d17d28 33250->33251 33252 d17d6d 33250->33252 33254 d070e4 41 API calls 33251->33254 33319 d16775 CharUpperW Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33252->33319 33256 d17d30 33254->33256 33255 d17d78 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33320 d166d9 42 API calls 33255->33320 33257 d070e4 41 API calls 33256->33257 33258 d17d3e 33257->33258 33318 d166d9 42 API calls 33258->33318 33261 d17d97 33263 d07204 41 API calls 33261->33263 33262 d17d4f 33264 d07204 41 API calls 33262->33264 33263->33231 33264->33231 33265->33153 33266->33158 33268->33108 33271->33151 33274->33219 33275->33217 33276->33217 33277->33217 33279 d1773c __EH_prolog3 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33278->33279 33280 d07e29 41 API calls 33279->33280 33281 d17784 33280->33281 33282 d070e4 41 API calls 33281->33282 33283 d17790 33282->33283 33284 d071a5 41 API calls 33283->33284 33285 d177b3 33283->33285 33284->33285 33321 d187cf 33285->33321 33287 d177d2 33288 d1782f 33287->33288 33296 d17853 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33287->33296 33344 d11261 41 API calls 33288->33344 33290 d17838 33294 d178ee std::locale::locale 33290->33294 33297 d1792f Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33290->33297 33348 d16bee 20 API calls 33290->33348 33294->33232 33296->33290 33345 d16775 CharUpperW Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33296->33345 33346 d18841 41 API calls 33296->33346 33347 d11261 41 API calls 33296->33347 33297->33294 33301 d0b92d 15 API calls 33297->33301 33303 d17b1d 33297->33303 33305 d17b03 33297->33305 33325 d132d7 33297->33325 33328 d1770b 33297->33328 33331 d0d3a8 33297->33331 33349 d17527 42 API calls 2 library calls 33297->33349 33350 d17b31 41 API calls 33297->33350 33300 d0b92d 15 API calls 33300->33294 33301->33297 33304 d0b92d 15 API calls 33303->33304 33304->33305 33305->33300 33308->33234 33309->33236 33310->33238 33311->33240 33312->33242 33313->33244 33315 d07e3e 33314->33315 33316 d07108 41 API calls 33315->33316 33317 d07e4f 33316->33317 33317->33247 33318->33262 33319->33255 33320->33261 33322 d187e6 33321->33322 33323 d187de 33321->33323 33322->33287 33324 d20c5c 41 API calls 33323->33324 33324->33322 33351 d0a541 33325->33351 33358 d16e10 33328->33358 33330 d1771e 33330->33297 33332 d0d3fb 33331->33332 33368 d0dc7c 33332->33368 33334 d0d42a 33335 d0d44a 33334->33335 33374 d0fb15 33334->33374 33338 d0b92d 15 API calls 33335->33338 33337 d0d446 33337->33335 33340 d0d466 33337->33340 33339 d0d462 33338->33339 33341 d20b18 __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 33339->33341 33343 d0b92d 15 API calls 33340->33343 33342 d0d4b7 33341->33342 33342->33297 33343->33339 33344->33290 33345->33296 33346->33296 33347->33296 33348->33297 33349->33297 33350->33297 33354 d11a02 33351->33354 33352 d0a554 33352->33297 33355 d11a34 33354->33355 33357 d11a2d 33354->33357 33356 d09605 SetFilePointer GetLastError SetFilePointer GetLastError SetLastError 33355->33356 33356->33357 33357->33352 33359 d16e1c Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock __EH_prolog3_catch 33358->33359 33362 d10046 33359->33362 33360 d16e2e std::locale::locale 33360->33330 33363 d10052 __EH_prolog3 33362->33363 33364 d20cd9 std::_Facet_Register 41 API calls 33363->33364 33365 d1005c 33364->33365 33366 d0ce16 12 API calls 33365->33366 33367 d1006b std::locale::locale 33366->33367 33367->33360 33369 d0dc93 33368->33369 33381 d13381 33369->33381 33372 d0dcb3 33372->33334 33375 d0fb21 __EH_prolog3_catch 33374->33375 33403 d0f817 33375->33403 33377 d0fb30 33380 d0fb44 std::locale::locale 33377->33380 33428 d0d734 RaiseException Concurrency::cancel_current_task 33377->33428 33380->33337 33382 d132bb SetFilePointer GetLastError SetFilePointer GetLastError SetLastError 33381->33382 33387 d133b1 33382->33387 33383 d0dca2 33383->33372 33391 d0daf4 33383->33391 33384 d133f7 33385 d0b92d 15 API calls 33384->33385 33386 d133ff 33385->33386 33388 d0a541 SetFilePointer GetLastError SetFilePointer GetLastError SetLastError 33386->33388 33387->33383 33387->33384 33389 d133eb 33387->33389 33388->33383 33390 d0b92d 15 API calls 33389->33390 33390->33383 33392 d0db00 __EH_prolog3 33391->33392 33393 d13484 ReadFile GetLastError 33392->33393 33395 d0db12 33393->33395 33394 d0db25 std::locale::locale 33394->33372 33395->33394 33396 d0d594 16 API calls 33395->33396 33399 d0db49 ctype 33396->33399 33397 d0dc63 33398 d0d554 14 API calls 33397->33398 33398->33394 33399->33397 33400 d0dc28 ctype 33399->33400 33402 d118ed ReadFile GetLastError 33399->33402 33401 d0a541 SetFilePointer GetLastError SetFilePointer GetLastError SetLastError 33400->33401 33401->33397 33402->33399 33404 d0f823 __EH_prolog3 33403->33404 33422 d0f8e2 std::locale::locale 33404->33422 33427 d11a02 SetFilePointer GetLastError SetFilePointer GetLastError SetLastError 33404->33427 33405 d0f98e 33406 d0fe49 41 API calls 33405->33406 33405->33422 33407 d0f9a6 33406->33407 33408 d13484 ReadFile GetLastError 33407->33408 33411 d0f9c7 33408->33411 33409 d0fb0f 33410 d0d72f RaiseException 33409->33410 33413 d0fb14 __EH_prolog3_catch 33410->33413 33411->33409 33412 d0d7ac RaiseException 33411->33412 33411->33422 33418 d0fa08 33412->33418 33414 d0f817 90 API calls 33413->33414 33415 d0fb30 33414->33415 33416 d0d734 RaiseException 33415->33416 33421 d0fb44 std::locale::locale 33415->33421 33419 d0fb76 33416->33419 33417 d0fad0 33420 d0f039 90 API calls 33417->33420 33418->33409 33418->33417 33423 d0edfb 90 API calls 33418->33423 33420->33422 33421->33377 33422->33377 33424 d0fa59 33423->33424 33424->33409 33424->33422 33425 d0d7ac RaiseException 33424->33425 33426 d0fabe 33425->33426 33426->33409 33426->33417 33427->33405 33430 d06ef5 41 API calls 33429->33430 33431 d07079 33430->33431 33431->33170 33494 d0c085 33432->33494 33436 d0aff4 __EH_prolog3 33435->33436 33650 d0aa08 33436->33650 33438 d0b03b 33488 d0b047 std::locale::locale 33438->33488 33653 d0ab36 33438->33653 33440 d0b06e 33663 d10667 33440->33663 33442 d0b079 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33443 d20cd9 std::_Facet_Register 41 API calls 33442->33443 33487 d0b1d3 33442->33487 33442->33488 33464 d0b0e9 33443->33464 33444 d0b52b 33447 d20cd9 std::_Facet_Register 41 API calls 33444->33447 33445 d0b1c1 33702 d0b865 41 API calls 33445->33702 33448 d0b557 33447->33448 33679 d0b889 33448->33679 33451 d0b566 33480 d0b5af 33451->33480 33493 d11a02 5 API calls 33451->33493 33452 d0b371 33703 d0b852 15 API calls 33452->33703 33454 d0b719 33683 d0b8fc 33454->33683 33456 d0b92d 15 API calls 33458 d0b7ef 33456->33458 33457 d20cd9 41 API calls std::_Facet_Register 33457->33480 33707 d0ba0c 33458->33707 33459 d0a541 5 API calls 33459->33480 33461 d0b70f 33465 d0b92d 15 API calls 33461->33465 33462 d0b610 33468 d0b92d 15 API calls 33462->33468 33463 d0b714 33463->33456 33464->33445 33464->33452 33464->33488 33700 d1147c 42 API calls 3 library calls 33464->33700 33701 d0b852 15 API calls 33464->33701 33465->33463 33466 d0b72c Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33466->33463 33477 d0b789 33466->33477 33706 d10865 RaiseException Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33466->33706 33468->33488 33470 d0b5cf 33472 d0b92d 15 API calls 33470->33472 33471 d0b5dc 33473 d0b92d 15 API calls 33471->33473 33472->33488 33473->33488 33474 d0b77e 33475 d20cd9 std::_Facet_Register 41 API calls 33474->33475 33474->33477 33475->33477 33687 d13544 33477->33687 33691 d10f51 33477->33691 33478 d0b7ce 33479 d0b92d 15 API calls 33478->33479 33479->33463 33480->33454 33480->33457 33480->33459 33480->33461 33480->33463 33482 d0b92d 15 API calls 33480->33482 33705 d0ba39 41 API calls std::_Facet_Register 33480->33705 33481 d0b92d 15 API calls 33481->33487 33482->33480 33484 d0b8fc 41 API calls 33484->33487 33485 d0b5e9 33486 d0b92d 15 API calls 33485->33486 33486->33488 33487->33444 33487->33462 33487->33470 33487->33471 33487->33481 33487->33484 33487->33485 33487->33488 33669 d153a6 33487->33669 33674 d0127e 33487->33674 33704 d0b96d 41 API calls 33487->33704 33488->33042 33493->33480 33497 d0c08a 33494->33497 33495 d0bef6 33495->33042 33497->33495 33499 d0befa 33497->33499 33505 d0c055 33497->33505 33500 d0bf06 __EH_prolog3 33499->33500 33509 d19487 33500->33509 33501 d0b92d 15 API calls 33502 d0c008 std::locale::locale 33501->33502 33502->33497 33503 d0bf81 33503->33501 33506 d0c05d 33505->33506 33631 d0c012 33506->33631 33578 d18d4a 33509->33578 33511 d194c0 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33512 d070e4 41 API calls 33511->33512 33524 d194c4 33511->33524 33513 d194de 33512->33513 33583 d0d1e1 33513->33583 33514 d194ff 33515 d19520 33514->33515 33516 d19519 33514->33516 33517 d1950b 33514->33517 33518 d0a167 VariantClear 33515->33518 33516->33515 33605 d072c2 42 API calls 33516->33605 33519 d07204 41 API calls 33517->33519 33518->33524 33521 d19517 33519->33521 33522 d07204 41 API calls 33521->33522 33523 d19541 33522->33523 33525 d0a167 VariantClear 33523->33525 33524->33503 33527 d19549 33525->33527 33526 d0a167 VariantClear 33526->33524 33527->33515 33527->33524 33528 d195f0 33527->33528 33529 d19608 33527->33529 33572 d19681 33527->33572 33530 d0a167 VariantClear 33528->33530 33531 d0a167 VariantClear 33529->33531 33532 d195f8 33530->33532 33534 d19621 33531->33534 33533 d0a167 VariantClear 33532->33533 33533->33524 33534->33515 33535 d19642 33534->33535 33535->33572 33591 d07d7d 33535->33591 33537 d19675 33538 d0717a 41 API calls 33537->33538 33537->33572 33539 d196a7 33538->33539 33540 d196cf 33539->33540 33606 d19418 42 API calls 3 library calls 33539->33606 33541 d070a2 41 API calls 33540->33541 33543 d196de 33541->33543 33544 d19721 33543->33544 33545 d196e4 33543->33545 33546 d083fd 41 API calls 33544->33546 33547 d07204 41 API calls 33545->33547 33548 d1972c 33546->33548 33549 d196f2 33547->33549 33552 d08f6e 55 API calls 33548->33552 33550 d196f6 33549->33550 33551 d19709 33549->33551 33607 d0837d RemoveDirectoryW 33550->33607 33608 d08326 CreateFileW SetFileTime CloseHandle Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33551->33608 33554 d19744 33552->33554 33557 d19783 33554->33557 33559 d0858f 3 API calls 33554->33559 33556 d1971c 33565 d19704 33556->33565 33558 d197eb 33557->33558 33560 d20cd9 std::_Facet_Register 41 API calls 33557->33560 33561 d07204 41 API calls 33558->33561 33562 d1974f 33559->33562 33566 d1978e 33560->33566 33561->33565 33562->33557 33563 d19753 33562->33563 33564 d07320 41 API calls 33563->33564 33564->33572 33567 d0a167 VariantClear 33565->33567 33602 d19251 33566->33602 33567->33524 33570 d197b0 33571 d07320 41 API calls 33570->33571 33573 d197c0 33571->33573 33572->33526 33574 d0b92d 15 API calls 33573->33574 33574->33572 33575 d197ca 33576 d0b92d 15 API calls 33575->33576 33576->33558 33609 d0a6ae 33578->33609 33615 d0a1af 33583->33615 33585 d0d212 33586 d0d238 33585->33586 33588 d0d316 33585->33588 33590 d0d247 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33585->33590 33586->33590 33619 d0dfef 33586->33619 33588->33590 33624 d0d027 RaiseException 33588->33624 33590->33514 33593 d07d89 __EH_prolog3 33591->33593 33592 d07e1b std::locale::locale 33592->33537 33593->33592 33594 d070e4 41 API calls 33593->33594 33600 d07dac 33594->33600 33595 d07dfb 33626 d07267 41 API calls 33595->33626 33597 d07e0f 33598 d068cc 41 API calls 33597->33598 33598->33592 33600->33595 33601 d068cc 41 API calls 33600->33601 33625 d07267 41 API calls 33600->33625 33601->33600 33627 d0980b 33602->33627 33605->33521 33606->33540 33607->33565 33608->33556 33610 d0a697 EnterCriticalSection 33609->33610 33611 d0a6be 33610->33611 33612 d0a6c5 33611->33612 33613 d0a6a7 ~refcount_ptr LeaveCriticalSection 33612->33613 33614 d0a6ec 33613->33614 33614->33511 33616 d0a1d9 VariantClear 33615->33616 33617 d0a1bd 33615->33617 33618 d0a1d2 33616->33618 33617->33616 33617->33618 33618->33585 33620 d0a1af VariantClear 33619->33620 33621 d0e001 33620->33621 33622 d0a02c SysAllocStringLen 33621->33622 33623 d0e057 33621->33623 33622->33623 33623->33590 33624->33590 33625->33600 33626->33597 33628 d09818 33627->33628 33629 d097f7 CreateFileW CloseHandle 33628->33629 33630 d09823 33629->33630 33630->33570 33630->33575 33632 d0c020 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33631->33632 33637 d11cea 33632->33637 33640 d0836f SetFileAttributesW 33632->33640 33641 d1987e 33632->33641 33633 d0c050 33633->33497 33638 d094c0 CloseHandle 33637->33638 33639 d11cf2 33638->33639 33640->33633 33642 d198b2 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33641->33642 33643 d198dc 33641->33643 33644 d07320 41 API calls 33642->33644 33647 d198bc 33642->33647 33645 d11cea CloseHandle 33643->33645 33646 d198f9 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33643->33646 33644->33647 33645->33646 33646->33647 33649 d0836f SetFileAttributesW 33646->33649 33647->33633 33649->33647 33711 d0df88 33650->33711 33652 d0aa1d 33652->33438 33654 d0ab50 33653->33654 33754 d0bae5 33654->33754 33657 d0ab6b 33757 d0bb6c 33657->33757 33658 d0abbe 33659 d0bae5 41 API calls 33658->33659 33660 d0abce Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33659->33660 33661 d0bb6c 41 API calls 33660->33661 33662 d0ac3f Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33661->33662 33662->33440 33665 d10673 __EH_prolog3 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33663->33665 33664 d10727 std::locale::locale 33664->33442 33665->33664 33666 d10708 33665->33666 33668 d11261 41 API calls 33665->33668 33666->33664 33776 d10605 41 API calls 33666->33776 33668->33665 33777 d051f6 33669->33777 33671 d153f6 33671->33487 33672 d153df 33672->33671 33785 d15367 15 API calls 33672->33785 33675 d01282 33674->33675 33676 d01285 33674->33676 33675->33487 33677 d26367 _Yarn 15 API calls 33676->33677 33678 d0128b 33677->33678 33678->33487 33680 d0b895 __EH_prolog3 33679->33680 33796 d0a650 33680->33796 33682 d0b8bc std::locale::locale 33682->33451 33684 d0b90c 33683->33684 33686 d0b920 33683->33686 33685 d20c5c 41 API calls 33684->33685 33685->33686 33686->33466 33688 d1354f 33687->33688 33689 d1356e 33688->33689 33690 d134f5 89 API calls 33688->33690 33689->33478 33690->33689 33804 d10beb 33691->33804 33693 d10f78 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33694 d13544 89 API calls 33693->33694 33696 d11067 33693->33696 33697 d10fbe Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33693->33697 33694->33693 33696->33478 33697->33696 33812 d108ea 33697->33812 33698 d1101b Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33698->33696 33823 d103ef 15 API calls Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33698->33823 33700->33464 33702->33487 33704->33487 33705->33480 33706->33474 33709 d0ba15 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33707->33709 33708 d0ba32 33709->33708 33867 d0bc88 15 API calls Concurrency::wait 33709->33867 33712 d0df9d 33711->33712 33718 d0dd01 33712->33718 33714 d0dfd5 33714->33652 33715 d0dfc7 33715->33714 33716 d24f11 Concurrency::cancel_current_task RaiseException 33715->33716 33717 d0dfee 33716->33717 33745 d0d9f5 RaiseException 33718->33745 33720 d0dd18 33736 d0df2e 33720->33736 33746 d0fcff 41 API calls 2 library calls 33720->33746 33723 d0deae 33750 d0fcbc 41 API calls 33723->33750 33725 d0deff 33725->33736 33751 d0fc79 41 API calls 33725->33751 33728 d0df25 33735 d0df5e 33728->33735 33728->33736 33730 d0dec3 33730->33725 33733 d0d9f5 RaiseException 33730->33733 33731 d0df55 33731->33715 33733->33730 33735->33731 33752 d0d9f5 RaiseException 33735->33752 33736->33731 33753 d0d734 RaiseException Concurrency::cancel_current_task 33736->33753 33741 d0d9f5 RaiseException 33743 d0dd36 33741->33743 33743->33723 33743->33736 33743->33741 33747 d0d71c RaiseException Concurrency::cancel_current_task 33743->33747 33748 d07cfa 41 API calls 33743->33748 33749 d0d86a RaiseException ctype 33743->33749 33745->33720 33746->33743 33747->33743 33748->33743 33749->33743 33750->33730 33751->33728 33752->33735 33760 d0bcbb 33754->33760 33768 d0bd1e 33757->33768 33761 d0bcc7 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33760->33761 33762 d0bcd7 33761->33762 33763 d0bd08 33761->33763 33767 d0baf5 33761->33767 33766 d20c5c 41 API calls 33762->33766 33764 d24f11 Concurrency::cancel_current_task RaiseException 33763->33764 33765 d0bd1d 33764->33765 33766->33767 33767->33657 33769 d0bd2a Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33768->33769 33770 d0bd3a 33769->33770 33771 d0bd6b 33769->33771 33775 d0bb7c 33769->33775 33774 d20c5c 41 API calls 33770->33774 33772 d24f11 Concurrency::cancel_current_task RaiseException 33771->33772 33773 d0bd80 33772->33773 33774->33775 33775->33658 33776->33664 33778 d05209 33777->33778 33783 d05277 33778->33783 33786 d05158 33778->33786 33783->33672 33784 d0127e 15 API calls 33784->33783 33785->33671 33788 d05183 33786->33788 33787 d0519b 33787->33783 33790 d050b9 33787->33790 33788->33787 33789 d0127e 15 API calls 33788->33789 33789->33787 33793 d0128d 33790->33793 33794 d2634c __freea 14 API calls 33793->33794 33795 d01293 33794->33795 33795->33784 33799 d066fe 33796->33799 33803 d213d0 33799->33803 33801 d0670a InitializeCriticalSection 33802 d06731 33801->33802 33802->33682 33803->33801 33807 d10bf7 __EH_prolog3 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33804->33807 33805 d11213 15 API calls 33805->33807 33806 d0ba39 41 API calls 33806->33807 33807->33805 33807->33806 33811 d10cc3 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33807->33811 33808 d10e47 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock std::locale::locale 33808->33693 33810 d0b92d 15 API calls 33810->33811 33811->33808 33811->33810 33824 d1312a 41 API calls std::_Facet_Register 33811->33824 33813 d108fe 33812->33813 33814 d0bd1e 41 API calls 33813->33814 33815 d10920 33814->33815 33816 d0bd1e 41 API calls 33815->33816 33817 d1092e Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33816->33817 33818 d109f5 33817->33818 33819 d1099b 33817->33819 33829 d13a1d 33818->33829 33825 d156e6 33819->33825 33820 d109f3 Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 33820->33698 33823->33698 33824->33811 33826 d156fa 33825->33826 33828 d156f3 33825->33828 33838 d1549e 33826->33838 33828->33820 33830 d13a4f 33829->33830 33837 d13c28 33829->33837 33830->33837 33852 d137ce 33830->33852 33832 d13c00 33835 d134a6 70 API calls 33832->33835 33832->33837 33834 d134a6 70 API calls 33836 d13a66 33834->33836 33835->33837 33836->33832 33836->33834 33836->33837 33857 d13951 33836->33857 33837->33820 33839 d154bb 33838->33839 33841 d1568f 33838->33841 33839->33841 33843 d12c91 33839->33843 33847 d134a6 33839->33847 33841->33828 33844 d12cb5 33843->33844 33845 d12cdb 33844->33845 33846 d0af0f 9 API calls 33844->33846 33845->33839 33846->33845 33848 d134b5 33847->33848 33849 d134e0 33848->33849 33850 d0c0c0 70 API calls 33848->33850 33851 d0c055 43 API calls 33848->33851 33849->33839 33850->33848 33851->33848 33855 d137e5 33852->33855 33856 d13824 33855->33856 33861 d01295 33855->33861 33864 d012ad 33855->33864 33856->33836 33859 d13984 33857->33859 33858 d139e5 33858->33836 33859->33858 33860 d12c91 9 API calls 33859->33860 33860->33859 33862 d01299 33861->33862 33863 d0129c VirtualAlloc 33861->33863 33862->33855 33863->33855 33865 d012b1 VirtualFree 33864->33865 33866 d012bf 33864->33866 33865->33866 33866->33855 33867->33709 33874 d264ce 33869->33874 33871 d06635 33889 d065a6 GetLastError 33871->33889 33873 d06641 33873->32385 33873->32388 33875 d264db 33874->33875 33876 d264ef 33874->33876 33899 d2b5b9 14 API calls __dosmaperr 33875->33899 33890 d2647e 33876->33890 33880 d264e0 33900 d269c7 39 API calls __Getctype 33880->33900 33881 d26504 CreateThread 33883 d26523 GetLastError 33881->33883 33887 d2652f 33881->33887 33920 d26372 33881->33920 33901 d2b55f 14 API calls __dosmaperr 33883->33901 33884 d264eb 33884->33871 33902 d263f0 33887->33902 33889->33873 33910 d2c381 33890->33910 33893 d2c2f9 ___free_lconv_mon 14 API calls 33894 d2649c 33893->33894 33895 d264a3 GetModuleHandleExW 33894->33895 33896 d264c0 33894->33896 33895->33896 33897 d263f0 16 API calls 33896->33897 33898 d264c8 33897->33898 33898->33881 33898->33887 33899->33880 33900->33884 33901->33887 33903 d26420 33902->33903 33904 d263fc 33902->33904 33903->33871 33905 d26402 CloseHandle 33904->33905 33906 d2640b 33904->33906 33905->33906 33907 d26411 FreeLibrary 33906->33907 33908 d2641a 33906->33908 33907->33908 33909 d2c2f9 ___free_lconv_mon 14 API calls 33908->33909 33909->33903 33911 d2c38e 33910->33911 33912 d2c3ce 33911->33912 33913 d2c3b9 HeapAlloc 33911->33913 33917 d2c3a2 __dosmaperr 33911->33917 33919 d2b5b9 14 API calls __dosmaperr 33912->33919 33915 d2c3cc 33913->33915 33913->33917 33916 d2648f 33915->33916 33916->33893 33917->33912 33917->33913 33918 d281ae std::_Facet_Register 2 API calls 33917->33918 33918->33917 33919->33916 33921 d2637e ___scrt_is_nonwritable_in_current_image 33920->33921 33922 d26392 33921->33922 33923 d26385 GetLastError ExitThread 33921->33923 33936 d2c71c GetLastError 33922->33936 33928 d263ae 33967 d13507 33928->33967 33937 d2c732 33936->33937 33940 d2c738 33936->33940 33976 d2cea2 6 API calls std::_Lockit::_Lockit 33937->33976 33960 d2c73c SetLastError 33940->33960 33977 d2cee1 6 API calls std::_Lockit::_Lockit 33940->33977 33941 d2c754 33943 d2c381 __dosmaperr 14 API calls 33941->33943 33941->33960 33946 d2c769 33943->33946 33944 d2c7d1 33982 d2b4d8 39 API calls CallUnexpected 33944->33982 33945 d26397 33963 d2d1e3 33945->33963 33947 d2c782 33946->33947 33948 d2c771 33946->33948 33979 d2cee1 6 API calls std::_Lockit::_Lockit 33947->33979 33978 d2cee1 6 API calls std::_Lockit::_Lockit 33948->33978 33953 d2c77f 33958 d2c2f9 ___free_lconv_mon 14 API calls 33953->33958 33954 d2c78e 33955 d2c792 33954->33955 33956 d2c7a9 33954->33956 33980 d2cee1 6 API calls std::_Lockit::_Lockit 33955->33980 33981 d2c54a 14 API calls __dosmaperr 33956->33981 33958->33960 33960->33944 33960->33945 33961 d2c7b4 33962 d2c2f9 ___free_lconv_mon 14 API calls 33961->33962 33962->33960 33964 d2d1f3 CallUnexpected 33963->33964 33965 d263a2 33963->33965 33964->33965 33983 d2cd71 33964->33983 33965->33928 33974 d2d0ee 5 API calls std::_Lockit::_Lockit 33965->33974 33969 d13517 33967->33969 33968 d1353b 33971 d26551 33968->33971 33969->33968 34001 d108b5 33969->34001 34005 d26427 33971->34005 33974->33928 33976->33940 33977->33941 33978->33953 33979->33954 33980->33953 33981->33961 33986 d2ccac 33983->33986 33987 d2ccdc 33986->33987 33991 d2ccd8 33986->33991 33987->33991 33993 d2cbe1 33987->33993 33990 d2ccf6 GetProcAddress 33990->33991 33992 d2cd06 std::_Lockit::_Lockit 33990->33992 33991->33965 33992->33991 33999 d2cbf2 ___vcrt_FlsFree 33993->33999 33994 d2cc88 33994->33990 33994->33991 33995 d2cc10 LoadLibraryExW 33996 d2cc2b GetLastError 33995->33996 33997 d2cc8f 33995->33997 33996->33999 33997->33994 33998 d2cca1 FreeLibrary 33997->33998 33998->33994 33999->33994 33999->33995 34000 d2cc5e LoadLibraryExW 33999->34000 34000->33997 34000->33999 34002 d108c1 __EH_prolog3_catch 34001->34002 34003 d108ea 78 API calls 34002->34003 34004 d108cf std::locale::locale 34003->34004 34004->33969 34014 d2c86d GetLastError 34005->34014 34007 d26474 ExitThread 34008 d26432 34008->34007 34009 d2644b 34008->34009 34037 d2d129 5 API calls std::_Lockit::_Lockit 34008->34037 34011 d2645e 34009->34011 34012 d26457 CloseHandle 34009->34012 34011->34007 34013 d2646a FreeLibraryAndExitThread 34011->34013 34012->34011 34013->34007 34015 d2c883 34014->34015 34016 d2c889 34014->34016 34038 d2cea2 6 API calls std::_Lockit::_Lockit 34015->34038 34034 d2c88d SetLastError 34016->34034 34039 d2cee1 6 API calls std::_Lockit::_Lockit 34016->34039 34019 d2c8a5 34021 d2c381 __dosmaperr 12 API calls 34019->34021 34019->34034 34022 d2c8ba 34021->34022 34023 d2c8c2 34022->34023 34024 d2c8d3 34022->34024 34040 d2cee1 6 API calls std::_Lockit::_Lockit 34023->34040 34041 d2cee1 6 API calls std::_Lockit::_Lockit 34024->34041 34027 d2c8df 34029 d2c8e3 34027->34029 34030 d2c8fa 34027->34030 34028 d2c8d0 34032 d2c2f9 ___free_lconv_mon 12 API calls 34028->34032 34042 d2cee1 6 API calls std::_Lockit::_Lockit 34029->34042 34043 d2c54a 14 API calls __dosmaperr 34030->34043 34032->34034 34034->34008 34035 d2c905 34036 d2c2f9 ___free_lconv_mon 12 API calls 34035->34036 34036->34034 34037->34009 34038->34016 34039->34019 34040->34028 34041->34027 34042->34028 34043->34035 34045 d0a8c3 34044->34045 34046 d0a8cc 34044->34046 34054 d0b9b2 34045->34054 34046->32413 34073 d1370b 34048->34073 34050 d136f8 Concurrency::wait 34050->32413 34081 d152c6 34051->34081 34053 d151f8 Concurrency::wait 34053->32413 34056 d0b9bb Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock 34054->34056 34055 d0b9d8 34056->34055 34058 d1037c 34056->34058 34061 d1030a 34058->34061 34062 d1033a 34061->34062 34063 d0ba0c 15 API calls 34062->34063 34064 d10342 34063->34064 34065 d0ba0c 15 API calls 34064->34065 34066 d1034a 34065->34066 34069 d103a1 34066->34069 34070 d103ac 34069->34070 34071 d0b92d 15 API calls 34070->34071 34072 d103bc 34071->34072 34074 d13745 34073->34074 34077 d13760 34074->34077 34079 d13784 34077->34079 34078 d012ad VirtualFree 34078->34079 34079->34078 34080 d1374d 34079->34080 34080->34050 34082 d1532f 34081->34082 34083 d0128d 14 API calls 34082->34083 34084 d15337 34083->34084 34085 d0b92d 15 API calls 34084->34085 34086 d15342 34085->34086 34086->34053 34088 d2850a 34087->34088 34089 d284f8 34087->34089 34099 d28377 34088->34099 34114 d21775 GetModuleHandleW 34089->34114 34093 d284fd 34093->34088 34115 d285ac GetModuleHandleExW 34093->34115 34094 d213b7 34094->32222 34098 d2855c 34100 d28383 ___scrt_is_nonwritable_in_current_image 34099->34100 34121 d2aac4 EnterCriticalSection 34100->34121 34102 d2838d 34122 d283e3 34102->34122 34104 d2839a 34126 d283b8 34104->34126 34107 d28562 34131 d28593 34107->34131 34109 d2856c 34110 d28580 34109->34110 34111 d28570 GetCurrentProcess TerminateProcess 34109->34111 34112 d285ac CallUnexpected 3 API calls 34110->34112 34111->34110 34113 d28588 ExitProcess 34112->34113 34114->34093 34116 d285eb GetProcAddress 34115->34116 34117 d2860c 34115->34117 34116->34117 34120 d285ff 34116->34120 34118 d28612 FreeLibrary 34117->34118 34119 d28509 34117->34119 34118->34119 34119->34088 34120->34117 34121->34102 34125 d283ef ___scrt_is_nonwritable_in_current_image CallUnexpected 34122->34125 34124 d28453 CallUnexpected 34124->34104 34125->34124 34129 d28e57 14 API calls 3 library calls 34125->34129 34130 d2ab0c LeaveCriticalSection 34126->34130 34128 d283a6 34128->34094 34128->34107 34129->34124 34130->34128 34134 d2d21d 5 API calls CallUnexpected 34131->34134 34133 d28598 CallUnexpected 34133->34109 34134->34133 34135 d2d26b 34136 d2d278 34135->34136 34140 d2d290 34135->34140 34192 d2b5b9 14 API calls __dosmaperr 34136->34192 34138 d2d27d 34193 d269c7 39 API calls __Getctype 34138->34193 34141 d2d288 34140->34141 34142 d2d2ef 34140->34142 34194 d2d84f 14 API calls 2 library calls 34140->34194 34155 d2d244 34142->34155 34145 d2d308 34162 d2f3b2 34145->34162 34148 d2d244 __fread_nolock 39 API calls 34149 d2d341 34148->34149 34149->34141 34150 d2d244 __fread_nolock 39 API calls 34149->34150 34151 d2d34f 34150->34151 34151->34141 34152 d2d244 __fread_nolock 39 API calls 34151->34152 34153 d2d35d 34152->34153 34154 d2d244 __fread_nolock 39 API calls 34153->34154 34154->34141 34156 d2d250 34155->34156 34157 d2d265 34155->34157 34195 d2b5b9 14 API calls __dosmaperr 34156->34195 34157->34145 34159 d2d255 34196 d269c7 39 API calls __Getctype 34159->34196 34161 d2d260 34161->34145 34163 d2f3be ___scrt_is_nonwritable_in_current_image 34162->34163 34164 d2f3c6 34163->34164 34168 d2f3e1 34163->34168 34263 d2b5a6 14 API calls __dosmaperr 34164->34263 34166 d2f3cb 34264 d2b5b9 14 API calls __dosmaperr 34166->34264 34169 d2f3f8 34168->34169 34171 d2f433 34168->34171 34265 d2b5a6 14 API calls __dosmaperr 34169->34265 34170 d2d310 34170->34141 34170->34148 34173 d2f451 34171->34173 34174 d2f43c 34171->34174 34197 d3160a EnterCriticalSection 34173->34197 34268 d2b5a6 14 API calls __dosmaperr 34174->34268 34175 d2f3fd 34266 d2b5b9 14 API calls __dosmaperr 34175->34266 34179 d2f441 34269 d2b5b9 14 API calls __dosmaperr 34179->34269 34180 d2f457 34183 d2f476 34180->34183 34184 d2f48b 34180->34184 34181 d2f405 34267 d269c7 39 API calls __Getctype 34181->34267 34270 d2b5b9 14 API calls __dosmaperr 34183->34270 34198 d2f4cb 34184->34198 34188 d2f486 34272 d2f4c3 LeaveCriticalSection __wsopen_s 34188->34272 34189 d2f47b 34271 d2b5a6 14 API calls __dosmaperr 34189->34271 34192->34138 34193->34141 34194->34142 34195->34159 34196->34161 34197->34180 34199 d2f4f5 34198->34199 34200 d2f4dd 34198->34200 34202 d2f837 34199->34202 34207 d2f538 34199->34207 34282 d2b5a6 14 API calls __dosmaperr 34200->34282 34298 d2b5a6 14 API calls __dosmaperr 34202->34298 34203 d2f4e2 34283 d2b5b9 14 API calls __dosmaperr 34203->34283 34206 d2f83c 34299 d2b5b9 14 API calls __dosmaperr 34206->34299 34209 d2f543 34207->34209 34212 d2f4ea 34207->34212 34214 d2f573 34207->34214 34284 d2b5a6 14 API calls __dosmaperr 34209->34284 34210 d2f550 34300 d269c7 39 API calls __Getctype 34210->34300 34212->34188 34213 d2f548 34285 d2b5b9 14 API calls __dosmaperr 34213->34285 34217 d2f58c 34214->34217 34218 d2f5c7 34214->34218 34219 d2f599 34214->34219 34217->34219 34226 d2f5b5 34217->34226 34289 d2c333 15 API calls 2 library calls 34218->34289 34286 d2b5a6 14 API calls __dosmaperr 34219->34286 34221 d2f59e 34287 d2b5b9 14 API calls __dosmaperr 34221->34287 34223 d2f5d8 34227 d2c2f9 ___free_lconv_mon 14 API calls 34223->34227 34273 d3601e 34226->34273 34230 d2f5e1 34227->34230 34228 d2f5a5 34288 d269c7 39 API calls __Getctype 34228->34288 34229 d2f713 34232 d2f787 34229->34232 34235 d2f72c GetConsoleMode 34229->34235 34233 d2c2f9 ___free_lconv_mon 14 API calls 34230->34233 34234 d2f78b ReadFile 34232->34234 34236 d2f5e8 34233->34236 34237 d2f7a3 34234->34237 34238 d2f7ff GetLastError 34234->34238 34235->34232 34239 d2f73d 34235->34239 34240 d2f5f2 34236->34240 34241 d2f60d 34236->34241 34237->34238 34244 d2f77c 34237->34244 34242 d2f763 34238->34242 34243 d2f80c 34238->34243 34239->34234 34245 d2f743 ReadConsoleW 34239->34245 34290 d2b5b9 14 API calls __dosmaperr 34240->34290 34292 d2e719 41 API calls 2 library calls 34241->34292 34261 d2f5b0 __fread_nolock 34242->34261 34293 d2b55f 14 API calls __dosmaperr 34242->34293 34296 d2b5b9 14 API calls __dosmaperr 34243->34296 34256 d2f7c8 34244->34256 34257 d2f7df 34244->34257 34244->34261 34245->34244 34250 d2f75d GetLastError 34245->34250 34246 d2c2f9 ___free_lconv_mon 14 API calls 34246->34212 34250->34242 34252 d2f5f7 34291 d2b5a6 14 API calls __dosmaperr 34252->34291 34253 d2f811 34297 d2b5a6 14 API calls __dosmaperr 34253->34297 34294 d2f1dd 44 API calls 2 library calls 34256->34294 34258 d2f7f8 34257->34258 34257->34261 34295 d2f023 42 API calls __fread_nolock 34258->34295 34261->34246 34262 d2f7fd 34262->34261 34263->34166 34264->34170 34265->34175 34266->34181 34267->34170 34268->34179 34269->34181 34270->34189 34271->34188 34272->34170 34274 d3602b 34273->34274 34275 d36038 34273->34275 34301 d2b5b9 14 API calls __dosmaperr 34274->34301 34278 d36044 34275->34278 34302 d2b5b9 14 API calls __dosmaperr 34275->34302 34277 d36030 34277->34229 34278->34229 34280 d36065 34303 d269c7 39 API calls __Getctype 34280->34303 34282->34203 34283->34212 34284->34213 34285->34210 34286->34221 34287->34228 34288->34261 34289->34223 34290->34252 34291->34261 34292->34226 34293->34261 34294->34261 34295->34262 34296->34253 34297->34261 34298->34206 34299->34210 34300->34212 34301->34277 34302->34280 34303->34277 34304 d1b49f 34306 d1b4a8 34304->34306 34305 d1b4d7 34308 d1adc7 34306->34308 34311 d26a64 34308->34311 34310 d1add0 34310->34305 34312 d26a70 ___scrt_is_nonwritable_in_current_image 34311->34312 34313 d26a92 34312->34313 34314 d26a7a 34312->34314 34331 d27f4a EnterCriticalSection 34313->34331 34339 d2b5b9 14 API calls __dosmaperr 34314->34339 34317 d26a9d 34320 d2d244 __fread_nolock 39 API calls 34317->34320 34321 d26ab5 34317->34321 34318 d26a7f 34340 d269c7 39 API calls __Getctype 34318->34340 34320->34321 34322 d26b45 34321->34322 34323 d26b1d 34321->34323 34332 d26a28 34322->34332 34341 d2b5b9 14 API calls __dosmaperr 34323->34341 34326 d26b22 34342 d269c7 39 API calls __Getctype 34326->34342 34327 d26b4b 34343 d26b75 LeaveCriticalSection __fread_nolock 34327->34343 34330 d26a8a 34330->34310 34331->34317 34333 d26a34 34332->34333 34335 d26a49 __fread_nolock 34332->34335 34344 d2b5b9 14 API calls __dosmaperr 34333->34344 34335->34327 34336 d26a39 34345 d269c7 39 API calls __Getctype 34336->34345 34338 d26a44 34338->34327 34339->34318 34340->34330 34341->34326 34342->34330 34343->34330 34344->34336 34345->34338

                                                                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                                                                              Function 00D1EE57 Relevance: 49.5, APIs: 9, Strings: 19, Instructions: 498COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 0 d1ee57-d1ee75 call d1df9d 3 d1ee77-d1ee86 call d1dfe6 0->3 4 d1ee8b-d1ef20 call d01c57 call d070e4 * 4 GetCommandLineW call d07108 call d067ec call d0675d call d070e4 call d080d2 call d067dc call d06c5a 0->4 9 d1f61d-d1f623 3->9 32 d1ef22-d1ef3a call d1de28 call d071a5 call d067dc 4->32 33 d1ef3f-d1ef69 call d06dd7 call d06788 call d1e84b 4->33 32->33 45 d1f5c3-d1f5c8 33->45 46 d1ef6f-d1ef7d call d06774 33->46 48 d1f5d6-d1f61b call d0675d * 6 45->48 49 d1f5ca-d1f5d1 call d1dfe6 45->49 46->45 54 d1ef83-d1efae call d070e4 * 2 call d068f7 call d077ee 46->54 48->9 49->48 71 d1efb0-d1efb4 54->71 72 d1efcb-d1f024 call d07a12 * 3 call d07d57 call d06774 54->72 74 d1f129-d1f132 call d169df 71->74 75 d1efba-d1efc6 call d1dfe6 71->75 96 d1f055-d1f0fa call d07a12 call d07204 call d0675d call d07a12 call d07204 call d0675d call d07a12 call d07204 call d0675d call d07a12 call d07204 call d0675d call d1eafd 72->96 97 d1f026-d1f02b 72->97 85 d1f5af-d1f5c1 call d0675d * 2 74->85 75->74 85->48 136 d1f137-d1f172 call d0675d * 3 call d169df call d1de90 call d06774 96->136 137 d1f0fc-d1f100 96->137 97->96 98 d1f02d-d1f04c call d06788 * 2 MessageBoxW 97->98 98->96 108 d1f04e-d1f050 98->108 110 d1f10e-d1f124 call d0675d * 3 108->110 110->74 152 d1f174-d1f17c call d08a77 136->152 153 d1f1ae-d1f1d5 call d20cd9 call d1e00f call d0bbca call d16898 136->153 137->110 139 d1f102-d1f109 call d1dfe6 137->139 139->110 157 d1f181-d1f183 152->157 173 d1f1d7-d1f1e3 call d1dfe6 153->173 174 d1f1e8-d1f21b call d070e4 call d19f5b 153->174 159 d1f185-d1f193 call d1dfe6 157->159 160 d1f198-d1f1a9 call d1dcba call d07204 157->160 167 d1f5a3-d1f5aa call d1deaa 159->167 160->153 167->85 179 d1f597-d1f59e call d0b92d 173->179 183 d1f221-d1f226 174->183 184 d1f2b2-d1f2d9 call d0675d call d1def0 call d06788 call d087b9 174->184 179->167 186 d1f2a4-d1f2ad call d0675d 183->186 187 d1f228-d1f22a 183->187 210 d1f58b-d1f592 call d1df1d 184->210 211 d1f2df-d1f2f8 call d06774 184->211 186->179 190 d1f23d-d1f249 call d0a3de 187->190 191 d1f22c-d1f231 187->191 200 d1f24e-d1f259 call d06774 190->200 191->190 194 d1f233-d1f239 191->194 194->186 197 d1f23b 194->197 197->200 205 d1f277-d1f29f call d0a2bf call d06788 * 2 MessageBoxW call d0675d 200->205 206 d1f25b-d1f272 call d1de7b call d07204 call d0675d 200->206 205->186 206->205 210->179 221 d1f417-d1f422 call d06774 211->221 222 d1f2fe-d1f34e call d0b92a call d0717a call d06788 call d06774 211->222 231 d1f424-d1f426 221->231 232 d1f42b-d1f483 call d07108 call d0758c call d0675d call d0717a call d1ebdb call d06774 221->232 244 d1f350-d1f368 call d0739a call d073e4 222->244 245 d1f36d-d1f38e call d0b92a call d0717a call d06774 222->245 231->210 262 d1f485-d1f497 call d07392 call d073e4 232->262 263 d1f49c-d1f511 call d0b92a call d0717a call d06788 CreateProcessW 232->263 244->245 264 d1f390-d1f398 245->264 265 d1f39a-d1f3a3 call d06788 245->265 262->263 292 d1f513-d1f517 263->292 293 d1f536-d1f549 CloseHandle call d0675d 263->293 267 d1f3aa-d1f3d7 ShellExecuteExW 264->267 265->267 272 d1f3d9-d1f3de 267->272 273 d1f3fe-d1f412 call d0675d 267->273 276 d1f3e0-d1f3e7 call d1dfe6 272->276 277 d1f3ec-d1f3f9 call d0675d 272->277 284 d1f54d-d1f554 call d0675d 273->284 276->277 289 d1f52f-d1f534 call d0675d 277->289 296 d1f587 284->296 297 d1f556-d1f582 WaitForSingleObject GetExitCodeProcess CloseHandle call d1e3f8 call d1feb6 284->297 289->210 298 d1f522-d1f52b call d0675d 292->298 299 d1f519-d1f51d call d1ea71 292->299 293->284 296->210 297->296 298->289 299->298
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1DF9D: GetVersionExW.KERNEL32(?), ref: 00D1DFC1
                                                                                                                                                                                                                                                                                              • GetCommandLineW.KERNEL32 ref: 00D1EEBD
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CommandLineVersion
                                                                                                                                                                                                                                                                                              • String ID: $%%T$<$BeginPrompt$Can't load config info$Cannot create temp folder archive$Cannot load codecs$Cannot open file$Config failed$D$ExecuteFile$ExecuteParameters$Install path is incorrect$InstallPath$Progress$RunProgram$Title$Unsupported Windows version$yes
                                                                                                                                                                                                                                                                                              • API String ID: 3524817977-283479591
                                                                                                                                                                                                                                                                                              • Opcode ID: f73ba12631a96ae78bd286f73c7ce54511ab060b27768f9d844dc8becf5590f5
                                                                                                                                                                                                                                                                                              • Instruction ID: 7b85b62372f6efc540566da1fa4113477ddaa6422caa0163f0fd73373ea2f5b9
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f73ba12631a96ae78bd286f73c7ce54511ab060b27768f9d844dc8becf5590f5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 65121031508340AAD724FB60D892BEFB3E5EF91304F40496DB59A561D2EF70AA49CB73
                                                                                                                                                                                                                                                                                              Function 00D08D20 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08D01: FindClose.KERNELBASE(?,?,00D08D4A,?,00000000,?), ref: 00D08D0B
                                                                                                                                                                                                                                                                                              • FindFirstFileW.KERNELBASE(00000001,?,?,00000000,?), ref: 00D08D54
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                                                                                                              • Opcode ID: ef34a98c8cd2ddaae8bb74e200b39aef1c5b8682982a5b8c1e7567a321433946
                                                                                                                                                                                                                                                                                              • Instruction ID: f3312ba31a0d942a894025bf88e1b594de51cf7516f15cb336e28edafbd4f067
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ef34a98c8cd2ddaae8bb74e200b39aef1c5b8682982a5b8c1e7567a321433946
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77F0C2365047448FC620EF34DC45AEAB798EBA6320F14071AA8A9872D1EB319805D7B1
                                                                                                                                                                                                                                                                                              Function 00D372BE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 307 d372be-d372ee call d3709a 310 d372f0-d372fb call d2b5a6 307->310 311 d37309-d37315 call d316e2 307->311 318 d372fd-d37304 call d2b5b9 310->318 316 d37317-d3732c call d2b5a6 call d2b5b9 311->316 317 d3732e-d37377 call d37005 311->317 316->318 326 d373e4-d373ed GetFileType 317->326 327 d37379-d37382 317->327 328 d375e3-d375e7 318->328 329 d37436-d37439 326->329 330 d373ef-d37420 GetLastError call d2b55f CloseHandle 326->330 332 d37384-d37388 327->332 333 d373b9-d373df GetLastError call d2b55f 327->333 335 d37442-d37448 329->335 336 d3743b-d37440 329->336 330->318 344 d37426-d37431 call d2b5b9 330->344 332->333 337 d3738a-d373b7 call d37005 332->337 333->318 341 d3744c-d3749a call d3162d 335->341 342 d3744a 335->342 336->341 337->326 337->333 350 d374b9-d374e1 call d36daf 341->350 351 d3749c-d374a8 call d37214 341->351 342->341 344->318 357 d374e3-d374e4 350->357 358 d374e6-d37527 350->358 351->350 356 d374aa 351->356 359 d374ac-d374b4 call d2fa35 356->359 357->359 360 d37529-d3752d 358->360 361 d37548-d37556 358->361 359->328 360->361 363 d3752f-d37543 360->363 364 d375e1 361->364 365 d3755c-d37560 361->365 363->361 364->328 365->364 367 d37562-d37595 CloseHandle call d37005 365->367 370 d37597-d375c3 GetLastError call d2b55f call d317f5 367->370 371 d375c9-d375dd 367->371 370->371 371->364
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D37005: CreateFileW.KERNELBASE(00000000,00000000,?,00D37367,?,?,00000000,?,00D37367,00000000,0000000C), ref: 00D37022
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00D373D2
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 00D373D9
                                                                                                                                                                                                                                                                                              • GetFileType.KERNELBASE(00000000), ref: 00D373E5
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00D373EF
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 00D373F8
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00D37418
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00D37565
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00D37597
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 00D3759E
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                                                                                                                                              • String ID: H
                                                                                                                                                                                                                                                                                              • API String ID: 4237864984-2852464175
                                                                                                                                                                                                                                                                                              • Opcode ID: 07ca2457f153b5e05fb2d6cce2cdda352f2c0d3e4dfd7b342eee2a2ab55fbfca
                                                                                                                                                                                                                                                                                              • Instruction ID: 7394d699c25b7f9c727304efa6cc9dbda2ef98428f1f424798317c1eb41cc2c8
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 07ca2457f153b5e05fb2d6cce2cdda352f2c0d3e4dfd7b342eee2a2ab55fbfca
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57A10272A186559FCF29EF68DC51BAE3BA1EB46324F180159F811EB391CB35D802CB71
                                                                                                                                                                                                                                                                                              Function 00D08946 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 146threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 00D0894D
                                                                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 00D08958
                                                                                                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00D08963
                                                                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,00000018,00D1F181), ref: 00D08970
                                                                                                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00D089BE
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(000000B7,?,00000018,00D1F181), ref: 00D08A06
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D0838A: CreateDirectoryW.KERNELBASE(00000000,00000000,00D19462,?,0000000C,00D196CF,?,?), ref: 00D0838D
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000018,00D1F181), ref: 00D08A21
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D08A7E
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CountCurrentErrorLastTick$CreateDirectoryH_prolog3H_prolog3_ProcessThread
                                                                                                                                                                                                                                                                                              • String ID: 7zS
                                                                                                                                                                                                                                                                                              • API String ID: 2326608673-4191664949
                                                                                                                                                                                                                                                                                              • Opcode ID: 258fb7e3251e14474a9d0b1b70d7ba7662987aa8727b7edc7d7ae7494df5259a
                                                                                                                                                                                                                                                                                              • Instruction ID: 330624798fdf44b1f67d4c4583084b5d8d7b642e3fe6bef7f66121b9dca3626d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 258fb7e3251e14474a9d0b1b70d7ba7662987aa8727b7edc7d7ae7494df5259a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9E41BC31A002048BCF18FBB0D9927EDB7A1EFA5304F540469F44AA72D2DE709E0ADB71
                                                                                                                                                                                                                                                                                              Function 00D0A44A Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleHandleA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 00D0A478
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00D0A47F
                                                                                                                                                                                                                                                                                              • GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 00D0A48D
                                                                                                                                                                                                                                                                                              • GlobalMemoryStatus.KERNEL32(?), ref: 00D0A4B4
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: GlobalMemoryStatus$AddressHandleModuleProc
                                                                                                                                                                                                                                                                                              • String ID: $@$GlobalMemoryStatusEx$kernel32.dll
                                                                                                                                                                                                                                                                                              • API String ID: 180289352-802862622
                                                                                                                                                                                                                                                                                              • Opcode ID: 8e7491fc3fb9bd8fef37f1f9deba54e4e257cfdaf43220066f800a08acfcfb48
                                                                                                                                                                                                                                                                                              • Instruction ID: ad4271637c2ec3b579c6298c184999430a01cadefdb24a85beffd6427aae86a6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e7491fc3fb9bd8fef37f1f9deba54e4e257cfdaf43220066f800a08acfcfb48
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7F115374A00308EBCB24EFA8DC09B9EBBF4BF08304F108418E509A7290DB75E905CB70
                                                                                                                                                                                                                                                                                              Function 00D2CBE1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 466 d2cbe1-d2cbed 467 d2cc7f-d2cc82 466->467 468 d2cbf2-d2cc03 467->468 469 d2cc88 467->469 471 d2cc10-d2cc29 LoadLibraryExW 468->471 472 d2cc05-d2cc08 468->472 470 d2cc8a-d2cc8e 469->470 473 d2cc2b-d2cc34 GetLastError 471->473 474 d2cc8f-d2cc9f 471->474 475 d2cca8-d2ccaa 472->475 476 d2cc0e 472->476 478 d2cc36-d2cc48 call d2c256 473->478 479 d2cc6d-d2cc7a 473->479 474->475 480 d2cca1-d2cca2 FreeLibrary 474->480 475->470 477 d2cc7c 476->477 477->467 478->479 483 d2cc4a-d2cc5c call d2c256 478->483 479->477 480->475 483->479 486 d2cc5e-d2cc6b LoadLibraryExW 483->486 486->474 486->479
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,70235687,?,00D2CCF0,?,?,00000000), ref: 00D2CCA2
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                                                                                                                              • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                                                                              • API String ID: 3664257935-537541572
                                                                                                                                                                                                                                                                                              • Opcode ID: b4fbd003ae393c6d3136da4521392efcafa201cd51c0794a6f1cb829b9accc10
                                                                                                                                                                                                                                                                                              • Instruction ID: ccc52f854bdbe981324dc2cb907e6fd97dbcf18210fd4e1b6b2c76267a542a9d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b4fbd003ae393c6d3136da4521392efcafa201cd51c0794a6f1cb829b9accc10
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17210576A21230EBC7219B65FC41A5F3758DF617B8F292210E819E7390D630ED00E6F0
                                                                                                                                                                                                                                                                                              Function 00D2F4CB Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 487 d2f4cb-d2f4db 488 d2f4f5-d2f4f7 487->488 489 d2f4dd-d2f4f0 call d2b5a6 call d2b5b9 487->489 491 d2f837-d2f844 call d2b5a6 call d2b5b9 488->491 492 d2f4fd-d2f503 488->492 503 d2f84f 489->503 509 d2f84a call d269c7 491->509 492->491 495 d2f509-d2f532 492->495 495->491 498 d2f538-d2f541 495->498 501 d2f543-d2f556 call d2b5a6 call d2b5b9 498->501 502 d2f55b-d2f55d 498->502 501->509 506 d2f833-d2f835 502->506 507 d2f563-d2f567 502->507 508 d2f852-d2f855 503->508 506->508 507->506 511 d2f56d-d2f571 507->511 509->503 511->501 512 d2f573-d2f58a 511->512 515 d2f5bf-d2f5c5 512->515 516 d2f58c-d2f58f 512->516 520 d2f5c7-d2f5ce 515->520 521 d2f599-d2f5b0 call d2b5a6 call d2b5b9 call d269c7 515->521 518 d2f591-d2f597 516->518 519 d2f5b5-d2f5bd 516->519 518->519 518->521 523 d2f632-d2f651 519->523 524 d2f5d2-d2f5f0 call d2c333 call d2c2f9 * 2 520->524 525 d2f5d0 520->525 552 d2f76a 521->552 527 d2f657-d2f663 523->527 528 d2f70d-d2f716 call d3601e 523->528 556 d2f5f2-d2f608 call d2b5b9 call d2b5a6 524->556 557 d2f60d-d2f630 call d2e719 524->557 525->524 527->528 533 d2f669-d2f66b 527->533 541 d2f787 528->541 542 d2f718-d2f72a 528->542 533->528 534 d2f671-d2f692 533->534 534->528 538 d2f694-d2f6aa 534->538 538->528 543 d2f6ac-d2f6ae 538->543 545 d2f78b-d2f7a1 ReadFile 541->545 542->541 547 d2f72c-d2f73b GetConsoleMode 542->547 543->528 548 d2f6b0-d2f6d3 543->548 550 d2f7a3-d2f7a9 545->550 551 d2f7ff-d2f80a GetLastError 545->551 547->541 553 d2f73d-d2f741 547->553 548->528 555 d2f6d5-d2f6eb 548->555 550->551 560 d2f7ab 550->560 558 d2f823-d2f826 551->558 559 d2f80c-d2f81e call d2b5b9 call d2b5a6 551->559 554 d2f76d-d2f777 call d2c2f9 552->554 553->545 561 d2f743-d2f75b ReadConsoleW 553->561 554->508 555->528 563 d2f6ed-d2f6ef 555->563 556->552 557->523 570 d2f763-d2f769 call d2b55f 558->570 571 d2f82c-d2f82e 558->571 559->552 567 d2f7ae-d2f7c0 560->567 568 d2f77c-d2f785 561->568 569 d2f75d GetLastError 561->569 563->528 574 d2f6f1-d2f708 563->574 567->554 578 d2f7c2-d2f7c6 567->578 568->567 569->570 570->552 571->554 574->528 582 d2f7c8-d2f7d8 call d2f1dd 578->582 583 d2f7df-d2f7ec 578->583 592 d2f7db-d2f7dd 582->592 584 d2f7f8-d2f7fd call d2f023 583->584 585 d2f7ee call d2f334 583->585 593 d2f7f3-d2f7f6 584->593 585->593 592->554 593->592
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                                                                              • Opcode ID: c08cc61834e9d345888e26b646201a4f406cbfb9dd2f787f588c83cfe18d88ef
                                                                                                                                                                                                                                                                                              • Instruction ID: aa8216a142bf28e2c1a96a5993c011e11d6a437dc6e6df42cb8e8f17d5e45c58
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c08cc61834e9d345888e26b646201a4f406cbfb9dd2f787f588c83cfe18d88ef
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 34B1E374A043659FDB11DFA8E880BADBBB1EF69318F184579E4019B392CB70D942CB70
                                                                                                                                                                                                                                                                                              Function 00D1C921 Relevance: 9.1, APIs: 6, Instructions: 75COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D1C928
                                                                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00D1C932
                                                                                                                                                                                                                                                                                              • int.LIBCPMT ref: 00D1C949
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1A795: std::_Lockit::_Lockit.LIBCPMT ref: 00D1A7A6
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1A795: std::_Lockit::~_Lockit.LIBCPMT ref: 00D1A7C0
                                                                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 00D1C989
                                                                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00D1C9AF
                                                                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00D1C9BC
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 55977855-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7c55427069341c00a3aaa3214ef22498dce2b2b9cdc20db9537515efaaab771d
                                                                                                                                                                                                                                                                                              • Instruction ID: 502f59ede59cd73239fe3da4669761511a9e1a0e52f8074fc10f759ef144a092
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7c55427069341c00a3aaa3214ef22498dce2b2b9cdc20db9537515efaaab771d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2621CF35A10129AFCB05EF68E811AEEB7B5EF14314F144409F415AB382DF709E45CBB1
                                                                                                                                                                                                                                                                                              Function 00D085C6 Relevance: 7.6, APIs: 5, Instructions: 123COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D085CD
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08F6E: __EH_prolog3.LIBCMT ref: 00D08F75
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(0000010B,00000000,00000000,0000005C,00D08B2F,?,00D1DED5,70235687,?,?,?,00D39BA9,000000FF), ref: 00D0860A
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000000,00000000,0000005C,00D08B2F,?,00D1DED5,70235687,?,?,?,00D39BA9,000000FF), ref: 00D086C8
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000000,00000000,0000005C,00D08B2F,?,00D1DED5,70235687,?,?,?,00D39BA9,000000FF), ref: 00D086E2
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,?,00000000,00000000,0000005C,00D08B2F,?,00D1DED5,70235687,?,?,?,00D39BA9,000000FF), ref: 00D08704
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3502553090-0
                                                                                                                                                                                                                                                                                              • Opcode ID: adc8106ca80ba2312924a2566e17c58e216ad37ae5ccce25c1b923505509802f
                                                                                                                                                                                                                                                                                              • Instruction ID: e4137e3ef5da8592639a60d9b88f7bbb143ce1f6191754f8762490f8f59c0ec2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: adc8106ca80ba2312924a2566e17c58e216ad37ae5ccce25c1b923505509802f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7E415B319002188ACF04FBA0DD65BEDB774EF65345F880068E48EB71D2EF245A0AEB71
                                                                                                                                                                                                                                                                                              Function 00D19D32 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D19D3C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08F6E: __EH_prolog3.LIBCMT ref: 00D08F75
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID: Cannot find archive file$Cannot open the file as archive$Default
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-3394896130
                                                                                                                                                                                                                                                                                              • Opcode ID: c1c409b685b73ca33f1a38b800caddcefab06bf28e2078ec46f489c60c591f16
                                                                                                                                                                                                                                                                                              • Instruction ID: 494f48944064a76f68469e7773841e8b9f06709dc7c17750195f9fd17f3aff65
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c1c409b685b73ca33f1a38b800caddcefab06bf28e2078ec46f489c60c591f16
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E9413171900104AADF08EFA0D8A2FEDB774EF14300F5441ADE95A6B1C2EF70AA49CB71
                                                                                                                                                                                                                                                                                              Function 00D08F6E Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 301COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 788 d08f6e-d08f96 call d39103 call d09b96 793 d08f9c-d08fa3 788->793 794 d0913d-d09168 call d08794 call d09b32 call d09a21 788->794 793->794 796 d08fa9-d08fd8 call d07108 * 2 call d080b8 call d06770 793->796 807 d0916a-d09171 794->807 808 d091bc 794->808 817 d08ff1-d08ff9 call d0741c 796->817 818 d08fda-d08fef call d08b38 call d06cb0 796->818 810 d091be-d091c7 807->810 811 d09173-d09180 call d08f5c 807->811 808->810 814 d091d2-d091d8 810->814 815 d091c9-d091cc 810->815 819 d092c5-d092ca call d08d20 811->819 823 d09186-d09188 811->823 820 d091da-d091e5 call d08f5c 814->820 821 d0920d-d09214 call d09ac1 814->821 815->814 815->819 832 d08ffe-d0900f call d06788 call d09b17 817->832 818->817 818->832 834 d092cf-d092d5 819->834 820->819 835 d091eb-d091ed 820->835 821->819 839 d0921a-d09222 821->839 823->819 830 d0918e-d091b7 call d08c32 call d071a5 call d08b65 call d09353 823->830 849 d09327-d0932a call d087af 830->849 865 d09011-d09014 832->865 866 d09046-d09053 call d08f6e 832->866 840 d09322 834->840 841 d092d7-d092d9 834->841 835->819 843 d091f3-d09208 call d08c32 call d0677c 835->843 839->819 847 d09228-d09231 call d099d4 839->847 842 d09324 840->842 841->840 848 d092db-d092e4 call d08310 841->848 842->849 843->849 847->819 867 d09237-d09247 call d09353 847->867 848->840 861 d092e6-d092ef call d09353 848->861 862 d0932f-d09337 call d390e0 849->862 861->849 873 d09024-d09036 call d08c32 call d0677c 865->873 874 d09016-d09019 865->874 887 d09059-d0907f call d08c03 call d0933a 866->887 888 d0912d-d09138 call d0675d * 2 866->888 883 d09257-d09289 call d07108 call d07d4f call d08b4a call d06788 call d08d20 867->883 884 d09249-d09252 call d071a5 867->884 873->887 900 d09038-d09044 call d07204 873->900 874->866 882 d0901b-d09022 874->882 882->866 882->873 925 d092a0-d092ae call d08f5c 883->925 926 d0928b-d0929a call d07d68 883->926 884->849 906 d090b0-d090c6 call d08f0b 887->906 888->794 900->887 914 d09081-d09085 906->914 915 d090c8 906->915 916 d09087-d0909d call d06788 call d08b54 914->916 917 d090fd-d090ff SetLastError 914->917 919 d09105 915->919 937 d090ca-d090d2 call d06770 916->937 938 d0909f-d090ab call d0934e call d0933a 916->938 917->919 921 d09108-d09128 call d0934e call d0879c call d0675d * 2 919->921 921->862 939 d092b0-d092b3 925->939 940 d092f1-d092fe call d08c32 925->940 935 d0930c-d09320 call d071a5 call d0675d 926->935 936 d0929c 926->936 935->842 936->925 955 d090e0-d090fb call d073e4 937->955 956 d090d4-d090db call d080b8 937->956 938->906 944 d092b5-d092b7 939->944 945 d092b9-d092c0 call d0675d 939->945 957 d09300-d09303 940->957 958 d09305-d09307 call d08be3 940->958 944->940 944->945 945->819 955->921 956->955 957->935 958->935
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D08F75
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000002,?,00D08BF8,?,?,?,?,?,00000050), ref: 00D090FF
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08D20: FindFirstFileW.KERNELBASE(00000001,?,?,00000000,?), ref: 00D08D54
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFileFindFirstH_prolog3Last
                                                                                                                                                                                                                                                                                              • String ID: :$DATA
                                                                                                                                                                                                                                                                                              • API String ID: 544173094-2587938151
                                                                                                                                                                                                                                                                                              • Opcode ID: f4a00c3c287fec2055a62d6147643d00731a7bcac94d68f7e1084b862cf139a7
                                                                                                                                                                                                                                                                                              • Instruction ID: aadeb0bb6a1c74c5f44bc6c25bc4ea72ff96991f7463bae19deb0cdef08149f8
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f4a00c3c287fec2055a62d6147643d00731a7bcac94d68f7e1084b862cf139a7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FAB16A70904205AACB14EBB4C8A1BEDF771EF55310F584519E49EA72C3EF30AA4ADB71
                                                                                                                                                                                                                                                                                              Function 00D17DC5 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 968 d17dc5-d17df8 call d39103 call d0a53b * 2 975 d17e22-d17e25 968->975 976 d17dfa-d17e20 call d20cd9 call d1804b call d0bb8c call d06788 968->976 977 d17e27-d17e60 call d20cd9 call d1182b call d0bb8c call d07204 call d06788 call d15a33 975->977 978 d17e9e-d17ea1 call d17b8f 975->978 976->978 1019 d17e65-d17e67 977->1019 985 d17ea6-d17eae 978->985 988 d17e70 985->988 989 d17eb0-d17eb4 985->989 990 d17e72-d17e89 call d0b92d * 2 call d390e0 988->990 989->988 993 d17eb6-d17eb9 989->993 993->988 994 d17ebb-d17ec8 call d16f45 993->994 994->988 1006 d17eca-d17ed5 call d06770 994->1006 1015 d17edb-d17ef0 call d08b38 call d06cb0 1006->1015 1016 d1802e-d18031 1006->1016 1015->1016 1029 d17ef6-d17f1e call d06770 call d165ec call d068ff 1015->1029 1016->990 1021 d17e69-d17e6e call d09474 1019->1021 1022 d17e8c-d17e9a call d06788 1019->1022 1021->988 1022->978 1036 d17f24-d17f3b call d068e6 call d16e02 1029->1036 1037 d18026-d18029 call d0675d 1029->1037 1043 d17f41-d17faa call d0717a call d0738a call d16dd2 call d073e4 call d0675d call d07204 call d0741c call d06788 call d16d48 1036->1043 1044 d18010-d18020 call d068ff 1036->1044 1037->1016 1065 d17fcd-d17fe0 call d06788 call d15a33 1043->1065 1066 d17fac-d17fcb call d07204 call d06788 call d16d48 1043->1066 1044->1036 1044->1037 1075 d17fe2-d18002 call d06788 call d16f97 call d17b8f 1065->1075 1076 d18004-d1800b call d0675d 1065->1076 1066->1065 1066->1076 1075->1076 1086 d18036-d18046 call d0675d * 2 1075->1086 1076->1044 1086->990
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D17DCC
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D17B8F: __EH_prolog3.LIBCMT ref: 00D17B96
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID: .001$.exe
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-2923188627
                                                                                                                                                                                                                                                                                              • Opcode ID: 394e9ba193877e087bc5013aa32501fe74c3bdb13ea11153a678eef3ef793b91
                                                                                                                                                                                                                                                                                              • Instruction ID: f2b525a2c7da13fcaaedd576d583e338fcac278553e1025a5f0cd81398fcbf18
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 394e9ba193877e087bc5013aa32501fe74c3bdb13ea11153a678eef3ef793b91
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8D71AF70904205AACB14FFB0D492AEEB7B4EF14304F444569E50A675D2EF30EE8ACBB1
                                                                                                                                                                                                                                                                                              Function 00D09605 Relevance: 4.6, APIs: 3, Instructions: 54COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1091 d09605-d0964a SetFilePointer 1092 d0964c-d09656 GetLastError 1091->1092 1093 d0966d-d0967f 1091->1093 1092->1093 1094 d09658-d0966b call d09584 SetLastError 1092->1094 1095 d09681-d09690 1093->1095 1094->1095
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetFilePointer.KERNELBASE(?,?,?,?,70235687,?,?,?,?,?,00D39BC6,000000FF), ref: 00D0963F
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,70235687,?,?,?,?,?,00D39BC6,000000FF), ref: 00D0964C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D09584: SetFilePointer.KERNEL32(?,00000000,?,00000001,70235687,?,?,?,?,?,00D39BC6,000000FF), ref: 00D095B8
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D09584: GetLastError.KERNEL32(?,00000000,?,00000001,70235687,?,?,?,?,?,00D39BC6,000000FF), ref: 00D095C5
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,?,?,70235687,?,?,?,?,?,00D39BC6,000000FF), ref: 00D09663
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$FilePointer
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1156039329-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2c45e0c865205e6e4e4c3d11b4289ddefccb8ac55408fa781caebd0cec284406
                                                                                                                                                                                                                                                                                              • Instruction ID: 1d415c01b0bfa4deeb24a86ebb108ece7f6adb8977e8a2b7859c44d2522d7763
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2c45e0c865205e6e4e4c3d11b4289ddefccb8ac55408fa781caebd0cec284406
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 95117C76A00219EFCB058F54DC54FAABBA8FB49320F00462AF816E7391D77598009B70
                                                                                                                                                                                                                                                                                              Function 00D264CE Relevance: 4.6, APIs: 3, Instructions: 51threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1098 d264ce-d264d9 1099 d264db-d264ee call d2b5b9 call d269c7 1098->1099 1100 d264ef-d26502 call d2647e 1098->1100 1105 d26530 1100->1105 1106 d26504-d26521 CreateThread 1100->1106 1110 d26532-d2653e call d263f0 1105->1110 1108 d26523-d2652f GetLastError call d2b55f 1106->1108 1109 d2653f-d26544 1106->1109 1108->1105 1114 d26546-d26549 1109->1114 1115 d2654b-d2654f 1109->1115 1114->1115 1115->1110
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateThread.KERNELBASE(?,00000000,Function_00026372,00000000,00000000,?), ref: 00D26517
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00D06635,00000000,00000000,00D061F7,?,00000000,?,?,?,?,00D05394,?,?,00D05B43,00000000), ref: 00D26523
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 00D2652A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateErrorLastThread__dosmaperr
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2744730728-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7a9ca4854c0db9a1cc6038339a09636ff9d8efe45bbe6d601cf228c7f21a893e
                                                                                                                                                                                                                                                                                              • Instruction ID: 9057401b6500869fea4e9dd319cceb08c85ea725edd9787b3bf749ecb444a766
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a9ca4854c0db9a1cc6038339a09636ff9d8efe45bbe6d601cf228c7f21a893e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62015E72510369AFDF15AFA4FC05A9F7BA4EF20768F044158F80196151DB71CE50DBB0
                                                                                                                                                                                                                                                                                              Function 00D26427 Relevance: 4.5, APIs: 3, Instructions: 30threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1118 d26427-d26434 call d2c86d 1121 d26436-d2643e 1118->1121 1122 d26474-d26477 ExitThread 1118->1122 1121->1122 1123 d26440-d26444 1121->1123 1124 d26446 call d2d129 1123->1124 1125 d2644b-d26451 1123->1125 1124->1125 1127 d26453-d26455 1125->1127 1128 d2645e-d26464 1125->1128 1127->1128 1130 d26457-d26458 CloseHandle 1127->1130 1128->1122 1129 d26466-d26468 1128->1129 1129->1122 1131 d2646a-d2646e FreeLibraryAndExitThread 1129->1131 1130->1128 1131->1122
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2C86D: GetLastError.KERNEL32(00000000,?,00D2B5BE,00D2C3D3,?,?,00D2C769,00000001,00000364,?,00000005,000000FF,?,00D26397,00D49388,0000000C), ref: 00D2C871
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2C86D: SetLastError.KERNEL32(00000000), ref: 00D2C913
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,?,00D2655E,?,?,00D263D0,00000000), ref: 00D26458
                                                                                                                                                                                                                                                                                              • FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,00D2655E,?,?,00D263D0,00000000), ref: 00D2646E
                                                                                                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 00D26477
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorExitLastThread$CloseFreeHandleLibrary
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1991824761-0
                                                                                                                                                                                                                                                                                              • Opcode ID: f56681d135341ae52dad7fc5c4fbd99fa86e7ce7b442e7232d5eb57124005246
                                                                                                                                                                                                                                                                                              • Instruction ID: 00a85ca6d6d6c10e27fcf008420e139bbc4abfd195b87de95a1b717beddcfb5c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f56681d135341ae52dad7fc5c4fbd99fa86e7ce7b442e7232d5eb57124005246
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8F082304047246BCB266B79EC0DA2A3BA9AF21768F5C8710B8A5D25A2D731DC52C7B0
                                                                                                                                                                                                                                                                                              Function 00D28562 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1132 d28562-d2856e call d28593 1135 d28580-d2858c call d285ac ExitProcess 1132->1135 1136 d28570-d2857a GetCurrentProcess TerminateProcess 1132->1136 1136->1135
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(00000002,?,00D2855C,00D2B51B,00D2B51B,?,00000002,70235687,00D2B51B,00000002), ref: 00D28573
                                                                                                                                                                                                                                                                                              • TerminateProcess.KERNEL32(00000000,?,00D2855C,00D2B51B,00D2B51B,?,00000002,70235687,00D2B51B,00000002), ref: 00D2857A
                                                                                                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00D2858C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 9ff81bc1f4ba89e93ef2cc8707b324c3f525dccf06dbef2ef638aaf181ef4655
                                                                                                                                                                                                                                                                                              • Instruction ID: 5a2508caf7b358d0bf1f6ecddb9c31036c8d6be3f097c2fd77668df15d5b6e3a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9ff81bc1f4ba89e93ef2cc8707b324c3f525dccf06dbef2ef638aaf181ef4655
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0CD09E32011314ABCF012FA0EC0D9893F25EF54355B485110F9499A272DF319991FBB4
                                                                                                                                                                                                                                                                                              Function 00D08A77 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D08A7E
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D088DE: GetTempPathW.KERNEL32(00000114,?), ref: 00D0890C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08946: __EH_prolog3_GS.LIBCMT ref: 00D0894D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08946: GetCurrentThreadId.KERNEL32 ref: 00D08958
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08946: GetTickCount.KERNEL32 ref: 00D08963
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08946: GetCurrentProcessId.KERNEL32(?,00000018,00D1F181), ref: 00D08970
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08946: GetTickCount.KERNEL32 ref: 00D089BE
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08946: SetLastError.KERNEL32(000000B7,?,00000018,00D1F181), ref: 00D08A06
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CountCurrentTick$ErrorH_prolog3H_prolog3_LastPathProcessTempThread
                                                                                                                                                                                                                                                                                              • String ID: 7zS
                                                                                                                                                                                                                                                                                              • API String ID: 1281145416-4191664949
                                                                                                                                                                                                                                                                                              • Opcode ID: a0042a0aab33edac35d74e045abefd90b59f11f90ad10b105a801e43336606b4
                                                                                                                                                                                                                                                                                              • Instruction ID: 2e675388336ef2f862cecc6ccf005480b2058a577f9ecd7d73f6a54cb59941b6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a0042a0aab33edac35d74e045abefd90b59f11f90ad10b105a801e43336606b4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 32016170D002448ACF14FBA0C5A3BEEB7B5EF55300F440499E555772C2EF65AE09DAB0
                                                                                                                                                                                                                                                                                              Function 00D0F817 Relevance: 3.2, APIs: 2, Instructions: 240COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3H_prolog3_catch
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1882928916-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 451cae872db17a85d9c07c5e53208f3b3508b2e653b6230756a9db16ff3ada3f
                                                                                                                                                                                                                                                                                              • Instruction ID: 97c8232573a8fb6d3c2cd8114582661b19029dc66c5fdbd1f470d39c6b755495
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 451cae872db17a85d9c07c5e53208f3b3508b2e653b6230756a9db16ff3ada3f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 91913A70A00745ABCB35DB78D4917EEB7E1EF58304F24442DE49EA3A91EB74A940CBB1
                                                                                                                                                                                                                                                                                              Function 00D26372 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00D49388,0000000C), ref: 00D26385
                                                                                                                                                                                                                                                                                              • ExitThread.KERNEL32 ref: 00D2638C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorExitLastThread
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1611280651-0
                                                                                                                                                                                                                                                                                              • Opcode ID: f69765074a7292e04776ce5eb0c674f45659b23b62ee91f83f302cd5bf0d23ae
                                                                                                                                                                                                                                                                                              • Instruction ID: 1bd02e9dbac40b0eeb0d9d2da95119003955c2eb364fbf619866bc7ca3cdab80
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f69765074a7292e04776ce5eb0c674f45659b23b62ee91f83f302cd5bf0d23ae
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89F0CD74A10728EFDB10EFB0E84AA6E3B75FF60744F144149F411AB2A2CB71A901DBB0
                                                                                                                                                                                                                                                                                              Function 00D2C2F9 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(00000000,00000000,?,00D32004,?,00000000,?,?,00D322A5,?,00000007,?,?,00D3289A,?,?), ref: 00D2C30F
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00D32004,?,00000000,?,?,00D322A5,?,00000007,?,?,00D3289A,?,?), ref: 00D2C31A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 485612231-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d4f43e098c17000f5596850ef1f49e8385dfe2e6c8a1d7eeff8163b073244a35
                                                                                                                                                                                                                                                                                              • Instruction ID: 105279cb52106b51b674d4f8523e6063850270a180fbb5b471413cff98f762ba
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d4f43e098c17000f5596850ef1f49e8385dfe2e6c8a1d7eeff8163b073244a35
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62E08C32210324ABCB112FA5BC08B9D3BA8EB643A9F085021F608DB275CB718840DBF0
                                                                                                                                                                                                                                                                                              Function 00D0A406 Relevance: 3.0, APIs: 2, Instructions: 7COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,00D0A427), ref: 00D0A40B
                                                                                                                                                                                                                                                                                              • GetProcessAffinityMask.KERNEL32(00000000), ref: 00D0A412
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Process$AffinityCurrentMask
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1231390398-0
                                                                                                                                                                                                                                                                                              • Opcode ID: dccec8ac0e02537cd11b33a9fb7670a2f0ccc104b3b75bab7e729d1e4a7f3a1e
                                                                                                                                                                                                                                                                                              • Instruction ID: 78ed66dc54db8b8a2b5e4c89b1806ef4a5acb4768d069eb0f487e133a2dbd55f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dccec8ac0e02537cd11b33a9fb7670a2f0ccc104b3b75bab7e729d1e4a7f3a1e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E9B092B3420240EBCE089BA0DD4C8163A2CAA04201300D544B105DA250C636C0018B30
                                                                                                                                                                                                                                                                                              Function 00D2FA65 Relevance: 2.6, APIs: 2, Instructions: 63COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,00000000,CF830579,?,00D2F94C,00000000,CF830579,00D49870,0000000C,00D2FA08,00D2806C,?), ref: 00D2FABB
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00D2F94C,00000000,CF830579,00D49870,0000000C,00D2FA08,00D2806C,?), ref: 00D2FAC5
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 245be976323fbfea73c116a8db990eccb5162a596e0ac8958d4ffe502cac96df
                                                                                                                                                                                                                                                                                              • Instruction ID: e929d83e1c987499747831347a6a10524669293ebf3e17e6f2cdfb14fb08c1d7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 245be976323fbfea73c116a8db990eccb5162a596e0ac8958d4ffe502cac96df
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2811E9376052345AD6286734B845B6D77658BA277CF3D0A39E8198A2D1DA619C808270
                                                                                                                                                                                                                                                                                              Function 00D065C3 Relevance: 2.5, APIs: 2, Instructions: 21COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00D05411,00000000,?,00D06576), ref: 00D065A6
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(?,?,00D053F5,00000020,?,?,00D05411,00000000,?,00D06576), ref: 00D065CD
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 918212764-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 4b48297315f45bdfd44a64021758466bb0a1e8c66fbc9781be9f8890f38138e7
                                                                                                                                                                                                                                                                                              • Instruction ID: c09d4d267cbf26a76ccac737915d080305897597b3f29b86ec580fee3ce6105a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4b48297315f45bdfd44a64021758466bb0a1e8c66fbc9781be9f8890f38138e7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 25E01731320261CBEB2D1E38EC0C7A672E8AF08352F14043EE087D11E4EBA0C8A09B60
                                                                                                                                                                                                                                                                                              Function 00D0AFE5 Relevance: 2.2, APIs: 1, Instructions: 654COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2a7df1f36fcf080ca4ebab77e55cd3ec6acaf54cec8f805e69c5036bdb721b05
                                                                                                                                                                                                                                                                                              • Instruction ID: 4fab620292948a76bdc0943185ec0cdb34772aeb2cbc111b3ba9dc146c43ed91
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a7df1f36fcf080ca4ebab77e55cd3ec6acaf54cec8f805e69c5036bdb721b05
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B9426B759042199FCB14EFA8C891BEDBBB1FF54314F54405AE8096B292DB30EE46CBB1
                                                                                                                                                                                                                                                                                              Function 00D18087 Relevance: 1.9, APIs: 1, Instructions: 393COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a60769aa9ae9fb4db34044072a3b81eec2758319529c6c55e9f8156884dfd314
                                                                                                                                                                                                                                                                                              • Instruction ID: 623a2284c28ee194dcd40e23c550f3cfc7375db03110eba6e6b8600f3365a894
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a60769aa9ae9fb4db34044072a3b81eec2758319529c6c55e9f8156884dfd314
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 49E18C31D00219ABDF14EBA4E891AEDB3B5EF54310F5441A9E40977292DF30AE85DFB1
                                                                                                                                                                                                                                                                                              Function 00D17730 Relevance: 1.8, APIs: 1, Instructions: 327COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1567d46ab04640ac1554b9da8a38b836f65d830591ab828a8d6efc1cbd4276a7
                                                                                                                                                                                                                                                                                              • Instruction ID: 7216a65fd73ec0323d62a9370f022c1d9f23467d2f3e0befd131442c80344a9c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1567d46ab04640ac1554b9da8a38b836f65d830591ab828a8d6efc1cbd4276a7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EDD15071D08216AFDB14EFA4E891BEDB7B4EF14314F144169E805AB292DF309E85CBB1
                                                                                                                                                                                                                                                                                              Function 00D17B8F Relevance: 1.7, APIs: 1, Instructions: 184COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D17B96
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D17730: __EH_prolog3.LIBCMT ref: 00D17737
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 88b0f124eba69384b8f4a84e0c443b5029f6af796c32c0978d4477726857bb0f
                                                                                                                                                                                                                                                                                              • Instruction ID: 45a8813a64f39642296743086139bf15fd57dae69c4650f765e38aab748ac8f2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 88b0f124eba69384b8f4a84e0c443b5029f6af796c32c0978d4477726857bb0f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C7518F30A04205ABDB18FBB0D855AEEB3BAEF94304F444529F40A972E1EF74ED95C671
                                                                                                                                                                                                                                                                                              Function 00D1EBDB Relevance: 1.7, APIs: 1, Instructions: 157COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3_
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2427045233-0
                                                                                                                                                                                                                                                                                              • Opcode ID: bf227804df81b02bfb8cd6eff9612cc4fd9efeeace4355368d404b61a18deb99
                                                                                                                                                                                                                                                                                              • Instruction ID: fa0ce88510ca733ac046bdf4d3c6e4e77fb248f023e32827c62f176aeee3c460
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bf227804df81b02bfb8cd6eff9612cc4fd9efeeace4355368d404b61a18deb99
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47516D70900158AADF19FB64D851BEDB7B5EF64300F0082A9A45A672D2EF705E89CF71
                                                                                                                                                                                                                                                                                              Function 00D108EA Relevance: 1.6, APIs: 1, Instructions: 146COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00D10A61
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Concurrency::details::_Lock::_ReaderScoped_lockScoped_lock::~_Writer
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3530792890-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c8a2067e0543b184bb5e9924c89bd7e2d72e45fe24a6dd511f32dd3d5bc77a0d
                                                                                                                                                                                                                                                                                              • Instruction ID: 4af04e2331f8001d0721696546e2621e490829890a7e1d63f3a3a93391be8ffa
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c8a2067e0543b184bb5e9924c89bd7e2d72e45fe24a6dd511f32dd3d5bc77a0d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 28516F75900705AFCB10EFA4C491AEEBBF8FF48304B54482DE58667691EB70A985CBB0
                                                                                                                                                                                                                                                                                              Function 00D0DAF4 Relevance: 1.6, APIs: 1, Instructions: 143COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: aa7804b691e427c3cd63266a968ee03a47d145b676ca7aaae3440abeeb68b0a8
                                                                                                                                                                                                                                                                                              • Instruction ID: d39bb76c0f8ddb559512f4772fb548a28fcdf81d30c26c8a409917acdeb67cef
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa7804b691e427c3cd63266a968ee03a47d145b676ca7aaae3440abeeb68b0a8
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3519271A002159BDF14DFA4C880BEEB3B6EF48714F19451AED19AB285DB71ED01CBB4
                                                                                                                                                                                                                                                                                              Function 00D18643 Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D1864A
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D16CB7: __EH_prolog3.LIBCMT ref: 00D16CBE
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D15A9E: __EH_prolog3.LIBCMT ref: 00D15AA5
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 9251a316f98d73904787626359d65b5a643ff1e23ff9b01a4d9c12f05ca99adf
                                                                                                                                                                                                                                                                                              • Instruction ID: 7f8e6b5e4ba9d141436db0a40b85eda7c3c0e04642f0e09952a77df2f1f41707
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9251a316f98d73904787626359d65b5a643ff1e23ff9b01a4d9c12f05ca99adf
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D0418D70900245AFCB15EFA0D891AEEB7B4FF54300F14856EE54667682EF70EA48CBB1
                                                                                                                                                                                                                                                                                              Function 00D0BEFA Relevance: 1.6, APIs: 1, Instructions: 105COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d6eb06941caab2f580ca7e5dc7a469a32b02ffdbd9fe3a9badc44744b0aba63c
                                                                                                                                                                                                                                                                                              • Instruction ID: b57d115fbe3fbca8b2598fe2498c23e10c51f2685db7ec2f2455e95fe123f5f5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d6eb06941caab2f580ca7e5dc7a469a32b02ffdbd9fe3a9badc44744b0aba63c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D631D071518603AFDB15DB24C890BA5BBA0FF54360F18826AE50D876C2DB20ED95CFF0
                                                                                                                                                                                                                                                                                              Function 00D19F5B Relevance: 1.6, APIs: 1, Instructions: 89COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D19F65
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1A0BC: __EH_prolog3.LIBCMT ref: 00D1A0C3
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1A13B: __EH_prolog3.LIBCMT ref: 00D1A142
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 75bcc1f18c4085a9aac4d350c2fa2e2e31dfa7384b6979e875ebf7df64414930
                                                                                                                                                                                                                                                                                              • Instruction ID: 9510f8b6543ad3323fe2cd026a5030a685245c8ff66a54906ae5981501e267d3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75bcc1f18c4085a9aac4d350c2fa2e2e31dfa7384b6979e875ebf7df64414930
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F2316B30904299AACF11EB68D852BDDB7B4EF14304F0480D9A50D6B282DF705A85CB72
                                                                                                                                                                                                                                                                                              Function 00D0AF0F Relevance: 1.6, APIs: 1, Instructions: 76COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ~refcount_ptr
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2759025673-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d8f2b124c225beeae10add19597621ca8bf578a3d46b320a509cb860f11b17c2
                                                                                                                                                                                                                                                                                              • Instruction ID: 30a4dcc15fc7729bfe99a7b1937b7f6e85aa37212d45259071cc882df7cb4180
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d8f2b124c225beeae10add19597621ca8bf578a3d46b320a509cb860f11b17c2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 963138B56007059FCB28CF18D850A6AB7F5FF84314B158A1DE85A87791DB34F905CBB1
                                                                                                                                                                                                                                                                                              Function 00D167BF Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D167C6
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D07636: __EH_prolog3.LIBCMT ref: 00D0763D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D07994: __EH_prolog3.LIBCMT ref: 00D0799B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 73ec92dc28c14da35b89d7a3204808fabdd55b03316341e74d0998605b7c7f6d
                                                                                                                                                                                                                                                                                              • Instruction ID: f5dc3b99571b0148cf4ea2b585d9b90987861adc9b45b5188318759111d3a406
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 73ec92dc28c14da35b89d7a3204808fabdd55b03316341e74d0998605b7c7f6d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A5212171D041599ACB05FBA4D8A1AEDB735EF14344F548068E50A671D2EF70AF4ACBB0
                                                                                                                                                                                                                                                                                              Function 00D1D42E Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                                                                              • Opcode ID: ffdeb92ec69c200f19ff0cfe70f8c4d9c3f4782567d401278b2b299b7c0f5cdc
                                                                                                                                                                                                                                                                                              • Instruction ID: fde6239190cd3b37c9db16bdc501e1fe0695fb159c78262994bd409f80f8a72a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ffdeb92ec69c200f19ff0cfe70f8c4d9c3f4782567d401278b2b299b7c0f5cdc
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FC0176B1502228368F287B78B822CEE7759DEA0358B100579F902D7603EF32C9D587F5
                                                                                                                                                                                                                                                                                              Function 00D16898 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7337aea17bcd4bdaa027b72d4a98af2de25cf5966bf865b5ea35b6f865b4a22f
                                                                                                                                                                                                                                                                                              • Instruction ID: 15cb7442980dd62a56d3f1a38d7dfe6f309d0a9fe6ba1554644f78e63d673f34
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7337aea17bcd4bdaa027b72d4a98af2de25cf5966bf865b5ea35b6f865b4a22f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1D216630C00208DBCF24EFA4D896AEDB7B0FF18304F140559E05667292EB74AA8ACB31
                                                                                                                                                                                                                                                                                              Function 00D2CCAC Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                                                                              • Opcode ID: 21a755091ec1a9104a2f21bdde4fdee7bd340df77598bb1a000bdd86ebb79ac1
                                                                                                                                                                                                                                                                                              • Instruction ID: 2805f98323969650ac42b8f616b4020b8e75451fa8fae6a781bb0ae4618b96bd
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 21a755091ec1a9104a2f21bdde4fdee7bd340df77598bb1a000bdd86ebb79ac1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE01D2372202299B9B168F68FC41A1A37A5FBE67683285025F514EB296EB30DC00D771
                                                                                                                                                                                                                                                                                              Function 00D35015 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __wsopen_s
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3347428461-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 680c600cf8e558706d8aa650c2105a7b3aeadad605c02a611791eb9a154a5b51
                                                                                                                                                                                                                                                                                              • Instruction ID: 034d0b8e1b2ee2a99f59eb48582a58ab1f5c57e81ec34a15bcf18652c2b3c8a3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 680c600cf8e558706d8aa650c2105a7b3aeadad605c02a611791eb9a154a5b51
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BA112771A0420AAFCF09DF68E94199B7BF5EF49304F044069F809EB351D671EA11CBA4
                                                                                                                                                                                                                                                                                              Function 00D07636 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a40c6f3e949bda98bc8af5e2e53e3bbb505e7374fe5cfc2e0174aa27bc88a860
                                                                                                                                                                                                                                                                                              • Instruction ID: acd2af0fb45144861ebd02a49227533297a7f53fc72450b87193ca81634a028c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a40c6f3e949bda98bc8af5e2e53e3bbb505e7374fe5cfc2e0174aa27bc88a860
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2901F130E0461546CF14BBA8C8627BEA371EF84344B94442DB41EAB2C2DFB6DC1686B0
                                                                                                                                                                                                                                                                                              Function 00D20CD9 Relevance: 1.5, APIs: 1, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • std::bad_exception::bad_exception.LIBCMT ref: 00D1A21D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D24F11: RaiseException.KERNEL32(E06D7363,00000001,00000003,?), ref: 00D24F71
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExceptionRaisestd::bad_exception::bad_exception
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 187513147-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b505f94671a75492f23eefdb3af402e327399255f645f323450eedc0f777534d
                                                                                                                                                                                                                                                                                              • Instruction ID: 383838d19d38dbde089dd5350fde33be9dfedb520abfeb7256cae37e7dfcbdd4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b505f94671a75492f23eefdb3af402e327399255f645f323450eedc0f777534d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4101267440031D778B00BAA5FD06CDEBB7CDE20364B508121FA18A2092EF71D59586F0
                                                                                                                                                                                                                                                                                              Function 00D1CF90 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D1CF97
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1D143: __EH_prolog3.LIBCMT ref: 00D1D14A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 570b6c2a7d0258de8f4e2d1e208f26f2e9237c37b501f3732845d4a4305dbdeb
                                                                                                                                                                                                                                                                                              • Instruction ID: 64cbde7d8dfb870b1edd603195056698de39e1c6a69f2d25583544dcfdf0abf2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 570b6c2a7d0258de8f4e2d1e208f26f2e9237c37b501f3732845d4a4305dbdeb
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8A115B74B10206AFDB04EF68D885BADB7BAFF48304F144119F505A7382CBB09A819BB1
                                                                                                                                                                                                                                                                                              Function 00D1AE06 Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3_align
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4143553397-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 65a69267713b399a47fb5241f0df6288f1a6d36458f1a4b6c7eaa333bfb40426
                                                                                                                                                                                                                                                                                              • Instruction ID: 2b71e26ffd5c512d2d1fdc15940297d942768e3db3f4a18a817ced08d6bff738
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 65a69267713b399a47fb5241f0df6288f1a6d36458f1a4b6c7eaa333bfb40426
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ED014F716151046BCB14F758E862BED7375DF54300F448099F00977292CF346D89CBB2
                                                                                                                                                                                                                                                                                              Function 00D1DA85 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D1DA8C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1AE06: __EH_prolog3_align.LIBCMT ref: 00D1AE12
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3H_prolog3_align
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1633742011-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 3f5da43e64a131c42468065d70f8e635ba0187fa49866bf6c41bf0aa927430d0
                                                                                                                                                                                                                                                                                              • Instruction ID: 462da45bc0bbef52d8fd43b7e46e77aaba33f2112446a4f48338160fe6632439
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3f5da43e64a131c42468065d70f8e635ba0187fa49866bf6c41bf0aa927430d0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 09016270E0415AAACF04FBA4E9557EEB777DF60304F148455E401A3246DFB85A86C6B2
                                                                                                                                                                                                                                                                                              Function 00D15A9E Relevance: 1.5, APIs: 1, Instructions: 38COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D15AA5
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D09474: GetLastError.KERNEL32(00D11CD1,70235687,?,?,00D39B8C,000000FF,?,00D11AE3,?), ref: 00D09474
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorH_prolog3Last
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 685212868-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 24fb7d541ec84c5faaaca3ec23c2d654225dc0977884e4c8b04200640b1a2a79
                                                                                                                                                                                                                                                                                              • Instruction ID: 0b56997fbd67f368e7f72215429f8c4699adefcd232268b5f8cb4892ff1c61ac
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 24fb7d541ec84c5faaaca3ec23c2d654225dc0977884e4c8b04200640b1a2a79
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 42012130615606AACB08FF70D992ADDB370FF60310B404228A15A175D2EF71E66ADBB4
                                                                                                                                                                                                                                                                                              Function 00D096AF Relevance: 1.5, APIs: 1, Instructions: 36timeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D0948B: CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,?,00D08BC5,?,00000000,00000001,00000003,02000000), ref: 00D094AD
                                                                                                                                                                                                                                                                                              • SetFileTime.KERNEL32(?,00000000,000000FF,00000000,?,80000100,?,00000003,00000080), ref: 00D096FC
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: File$CreateTime
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1043708186-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b26740a9c3ed4d350afd79409a1e6a209f6b56e32d982bfea2482624653ca594
                                                                                                                                                                                                                                                                                              • Instruction ID: 594cabcc1db0156e560e54afba0a5b7f247e93b459c85225c203cb338dbd7b52
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b26740a9c3ed4d350afd79409a1e6a209f6b56e32d982bfea2482624653ca594
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 97F02431240304BEFB258A04CC1BB9ABF98DB41720F248209F4EAA61E2C7A1AD008764
                                                                                                                                                                                                                                                                                              Function 00D1D143 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D1D14A
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1CA91: __EH_prolog3.LIBCMT ref: 00D1CA98
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1CA91: std::_Lockit::_Lockit.LIBCPMT ref: 00D1CAA2
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1CA91: int.LIBCPMT ref: 00D1CAB9
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1CA91: std::_Lockit::~_Lockit.LIBCPMT ref: 00D1CB1F
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1538362411-0
                                                                                                                                                                                                                                                                                              • Opcode ID: dd558378927976c8c1ae5613116d2e0cc2a73b12bf3488f80ae20e4a01597041
                                                                                                                                                                                                                                                                                              • Instruction ID: df637a1825a6a12e6557dfbb2140a75d4cf3f5e926d872099925501672044354
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dd558378927976c8c1ae5613116d2e0cc2a73b12bf3488f80ae20e4a01597041
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E0F05E71B50314BADF18FB70AC06BAE7369DF10751F004018B509A6181DFB9DAC587B2
                                                                                                                                                                                                                                                                                              Function 00D2C333 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,?,?,00D0128B,?,00D012CB), ref: 00D2C365
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AllocateHeap
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1279760036-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e2d391395befedc5d003f5a61e5e0bfc58f164b7af7c8f93dba11cf528b85484
                                                                                                                                                                                                                                                                                              • Instruction ID: 2e1f873f53012b6a5bd0c7d937e4eb36b3b0a9dee323effd7d06dd611128b9b5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e2d391395befedc5d003f5a61e5e0bfc58f164b7af7c8f93dba11cf528b85484
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36E0E53632033097DA216766BC0075E3658DF663ACF099521EC48D6195CB10DC0092F1
                                                                                                                                                                                                                                                                                              Function 00D1C9FE Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d25cba408d342d10b3996e6148c1a5775ded55fefcba00540e678bf10060d589
                                                                                                                                                                                                                                                                                              • Instruction ID: 6a14a4708cb56700a26d93c2d9a41074e33e15b32ccb66a7ce879ad6331d9840
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d25cba408d342d10b3996e6148c1a5775ded55fefcba00540e678bf10060d589
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B1F03476A10105AFCB04EF50EC16BAE7722EF90311F048018F1141B2A2DFB49901DB71
                                                                                                                                                                                                                                                                                              Function 00D08D89 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FindNextFileW.KERNELBASE(?,?), ref: 00D08DA9
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileFindNext
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2029273394-0
                                                                                                                                                                                                                                                                                              • Opcode ID: f229d6fba58230c7e07ec2a4b219ad0d944154714fb0873b15bd913ebc4c0018
                                                                                                                                                                                                                                                                                              • Instruction ID: 0fd832aaa9f41a6da3931f10edae2ff7ed17d83edf69f467b9cadf7b4fc56e10
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f229d6fba58230c7e07ec2a4b219ad0d944154714fb0873b15bd913ebc4c0018
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AFE0653160121CAFCB109F64EC459EA77B8EF65708F1040A9D405A7291EE31A949ABB4
                                                                                                                                                                                                                                                                                              Function 00D0858F Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08F5C: GetFileAttributesW.KERNELBASE(?,00D092A7,00000000,?,?,?,00000050,00D08BF8,?,00000001), ref: 00D08F5D
                                                                                                                                                                                                                                                                                              • DeleteFileW.KERNELBASE(00000000,?,00D1974F,00000000,00000000,?), ref: 00D085B9
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D0836F: SetFileAttributesW.KERNELBASE(00000000,00000000,00D085B2,?,00D1974F,00000000,00000000,?), ref: 00D08371
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: File$Attributes$Delete
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3735447641-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1708240974325edd8cc726cfbfc21972572fa4e3a6d64f482c3ec364f807e97b
                                                                                                                                                                                                                                                                                              • Instruction ID: 388500a5636004b65f098fa0a27037da9d540d90bc406e0bd00a69f04799f5e6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1708240974325edd8cc726cfbfc21972572fa4e3a6d64f482c3ec364f807e97b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89D0C221A1052006DE24253C3C0A3C9134E4F923B0F588722A4A9CB2D6DE69CC8622B0
                                                                                                                                                                                                                                                                                              Function 00D0A02C Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SysAllocStringLen.OLEAUT32(00000000,?), ref: 00D0A032
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AllocString
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2525500382-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a14d4ca80a3fb45aff6ebee831d6d638bd4d45936ce57b51fdb228ca49b7c3d7
                                                                                                                                                                                                                                                                                              • Instruction ID: c3dca73f25b7188299dc91d01833d508a6cc1f523c69d0c6f56fbce4da1c9d5b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a14d4ca80a3fb45aff6ebee831d6d638bd4d45936ce57b51fdb228ca49b7c3d7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88D017726947539EE3708F29B81479277E4AF44B20F21C82FE488DA2A4E675D8808391
                                                                                                                                                                                                                                                                                              Function 00D0948B Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D094C0: CloseHandle.KERNELBASE(?,70235687,?,00000000,00D39B8C,000000FF,?,00D09496,?,?,00D08BC5,?,00000000,00000001,00000003,02000000), ref: 00D094EC
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,?,00D08BC5,?,00000000,00000001,00000003,02000000), ref: 00D094AD
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseCreateFileHandle
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3498533004-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 4fdb8d0982043eafa8b0adb0c7dbf62dc9ed5f9a586f896333eb2a9eb43e876c
                                                                                                                                                                                                                                                                                              • Instruction ID: d0b66bf52c12a1b26670c083705ee3b26f468f5769fb9898d1d07c161f61dd72
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4fdb8d0982043eafa8b0adb0c7dbf62dc9ed5f9a586f896333eb2a9eb43e876c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AEE0EC32000219BBCF215FA49C06FC97B6AEF05760F148615FA58A51E1C772D8B1EBA4
                                                                                                                                                                                                                                                                                              Function 00D09855 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • WriteFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00D09875
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileWrite
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3934441357-0
                                                                                                                                                                                                                                                                                              • Opcode ID: cb6a6fde037ea64a740e41762eae0139983f305f279b778af4cd930131268f04
                                                                                                                                                                                                                                                                                              • Instruction ID: 3f7f1429c4546696a8ceed2f493f052d8f9a6962d0baa371a34c7c9bf3442772
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cb6a6fde037ea64a740e41762eae0139983f305f279b778af4cd930131268f04
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1DE0EE76610208EBCB05DFA0C805B9E7BB9EB48308F108069F906AB290D638AE04DB65
                                                                                                                                                                                                                                                                                              Function 00D0972D Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00D09743
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileRead
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2738559852-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 102f1a441ef1f60aa3751c51b8bf4f73e69297c682c47862e7c6543a657d0fb5
                                                                                                                                                                                                                                                                                              • Instruction ID: 6e790e7e12ddf3dd03cb18615ba77d3c805888fd300cf5a7b94ed33d81d207de
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 102f1a441ef1f60aa3751c51b8bf4f73e69297c682c47862e7c6543a657d0fb5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBE0EC75510208FBDF05DF90C805F9EBBBAEB45304F108059F9019A390D775AE14DB71
                                                                                                                                                                                                                                                                                              Function 00D093C0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D093C7
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08F6E: __EH_prolog3.LIBCMT ref: 00D08F75
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b3b4ef140cb8bd3300d2f3cbb7daa85c1847ca108c693bf82b8c94890cadd911
                                                                                                                                                                                                                                                                                              • Instruction ID: 38cf3c4603aa70b99b09fb8deaf80d69f7b04fc6084eae5551acb92afce0a419
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b3b4ef140cb8bd3300d2f3cbb7daa85c1847ca108c693bf82b8c94890cadd911
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 79D01735D511049ADB05FBA0C862BDCBB60EF11340F880059E255672C28EA85A0ADB74
                                                                                                                                                                                                                                                                                              Function 00D0691C Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 42dff960ce35dc2b6cef7b0f729cc30c5c9e721be52baa5101fadfc7aee1e954
                                                                                                                                                                                                                                                                                              • Instruction ID: 2a99d5664308f54fa4025d75e579e29dea30c09d39b5478b81ee68e1479bc950
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42dff960ce35dc2b6cef7b0f729cc30c5c9e721be52baa5101fadfc7aee1e954
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 37D05EB1A042109BEF09B7B49927B6DA660EF60750F004119F209AE2C2DFF24910D6B5
                                                                                                                                                                                                                                                                                              Function 00D0FB15 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3_catch.LIBCMT ref: 00D0FB1C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D0F817: __EH_prolog3.LIBCMT ref: 00D0F81E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3H_prolog3_catch
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1882928916-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 470751f63b7df27e863f1a7ecee42c06a3cf5df911965525686628a4ae4bd590
                                                                                                                                                                                                                                                                                              • Instruction ID: e0f13c33fadd0ca5e2aa1b8fb316f9bffd8ef1e8c9698966d4f581c11f3d224f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 470751f63b7df27e863f1a7ecee42c06a3cf5df911965525686628a4ae4bd590
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BBE05BB154824456DB359328C4153ADB5509B01300F7C856EA68C5B9D1C7F59881DB7F
                                                                                                                                                                                                                                                                                              Function 00D37005 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE(00000000,00000000,?,00D37367,?,?,00000000,?,00D37367,00000000,0000000C), ref: 00D37022
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 48f351c3c93c0c2c902fb3a21d1f446fe9816d94b52fc642825086810458b1f4
                                                                                                                                                                                                                                                                                              • Instruction ID: 12334189f9d75d8d3ecbd6b417a68ea5655ec580aa92dbd399f5b7095f77501c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 48f351c3c93c0c2c902fb3a21d1f446fe9816d94b52fc642825086810458b1f4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F4D06C3201024DFBDF028F84DC46EDA3BAAFB48714F014100BA18A6120C732E871EB90
                                                                                                                                                                                                                                                                                              Function 00D08D01 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FindClose.KERNELBASE(?,?,00D08D4A,?,00000000,?), ref: 00D08D0B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseFind
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1863332320-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2758e8eaf9aed01dcb84e489afd8e8052d5d0784128109fb3406f2737adc052e
                                                                                                                                                                                                                                                                                              • Instruction ID: 61ddbb37f0cf52052f87ae6878e30cf23d913b33cf4d41c6db472e8ece08eca1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2758e8eaf9aed01dcb84e489afd8e8052d5d0784128109fb3406f2737adc052e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2BD0C935020222AECE642E28B8042C17BA4AF22335335175DE0F5931E5D6714893AA60
                                                                                                                                                                                                                                                                                              Function 00D16E10 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3_catch
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3886170330-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d1623c1cfa40bc3c3fc78a2b13d332cf49b713992e49b477baea52173ae3d705
                                                                                                                                                                                                                                                                                              • Instruction ID: c4360ef6bd5693b90389dba2fb043a3519188e5510d202fae1a53694f951472f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d1623c1cfa40bc3c3fc78a2b13d332cf49b713992e49b477baea52173ae3d705
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5DD0C775604204EBCB44BBB4C91EB5D7764EF54366F04C414F74A96193CA74C550D732
                                                                                                                                                                                                                                                                                              Function 00D10046 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 3be5ad30b5e14058693f99d19c1c9f0041de8ccc4bef417374cfe7485b8f45f4
                                                                                                                                                                                                                                                                                              • Instruction ID: e48991baef4b6bc272560351a57f324c056f5f1b71231da0716de615b9c972e0
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3be5ad30b5e14058693f99d19c1c9f0041de8ccc4bef417374cfe7485b8f45f4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E7C01275A51201C6DF08B7F4A52735C61A0EB40354F404114B2016A2C2CEBA05009175
                                                                                                                                                                                                                                                                                              Function 00D08321 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FindClose.KERNELBASE(?,?,00D08D4A,?,00000000,?), ref: 00D08D0B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseFind
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1863332320-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b6de81246ebefcacac7ce1922162edb514c16467ef42cb4a62f011fcd20f3ba4
                                                                                                                                                                                                                                                                                              • Instruction ID: d48f77e6d869e8c8e64e68c756c1c0224e400f15319c959ba120df4c687f10ec
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b6de81246ebefcacac7ce1922162edb514c16467ef42cb4a62f011fcd20f3ba4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2EC08034020121FECE641E24780439137945F21335334435D90D5930E5DA314C53B670
                                                                                                                                                                                                                                                                                              Function 00D09827 Relevance: 1.5, APIs: 1, Instructions: 11timeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetFileTime.KERNELBASE(?,00000000,00000000,?), ref: 00D09833
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileTime
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1425588814-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 820a83bae8b534a8489591631dfe89c61947bb95c99db9dd8e626c04aecb8888
                                                                                                                                                                                                                                                                                              • Instruction ID: 89b392bbecf80ed439838c12b28fa9130daf57b9123726f4342124b856014077
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 820a83bae8b534a8489591631dfe89c61947bb95c99db9dd8e626c04aecb8888
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 16C08C31640308E7CF002FA0DC06F1B7B5AEB01B00F104029FA04592E0997268309734
                                                                                                                                                                                                                                                                                              Function 00D108B5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3_catch.LIBCMT ref: 00D108BC
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D108EA: Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00D10A61
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Concurrency::details::_H_prolog3_catchLock::_ReaderScoped_lockScoped_lock::~_Writer
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1114368199-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 073559b6e8c562e60f943c9559a31d384833a5eea9e669e731f1fe8ebe24bf82
                                                                                                                                                                                                                                                                                              • Instruction ID: 7b491754f3a42f987dd727becc72208b3816e4f397a9f20d91899dbd2528f340
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 073559b6e8c562e60f943c9559a31d384833a5eea9e669e731f1fe8ebe24bf82
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 10C04C30E9570556EB44B7948D1779DA560EB01B45F904058A24079281CAE856445776
                                                                                                                                                                                                                                                                                              Function 00D08F5C Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNELBASE(?,00D092A7,00000000,?,?,?,00000050,00D08BF8,?,00000001), ref: 00D08F5D
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AttributesFile
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3188754299-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 6c4d417a30aea58a63d08c09c92a2424f88bafbd87d57f2a007e47e0c49b57e3
                                                                                                                                                                                                                                                                                              • Instruction ID: 894a9f40d9746238b7f57f15f64c90b2e16e10c039a44ddc53944ee95b692861
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6c4d417a30aea58a63d08c09c92a2424f88bafbd87d57f2a007e47e0c49b57e3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E6B011B0320A808F8B2C83380C2A22832C0AA802323200B2EB233C02E0CB20C8000222
                                                                                                                                                                                                                                                                                              Function 00D0838A Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(00000000,00000000,00D19462,?,0000000C,00D196CF,?,?), ref: 00D0838D
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateDirectory
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4241100979-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 37bae6d584c24fa5ee9522ee01a7059333e85176f048adf13641f95753ce3f3b
                                                                                                                                                                                                                                                                                              • Instruction ID: 11eae4f60623e3495f9238d1a7e2ad1fe3667d3cd8bc05fec83edd48c4dfe5e6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 37bae6d584c24fa5ee9522ee01a7059333e85176f048adf13641f95753ce3f3b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 83A02230320300C3F22C0B302E8AF0E220C2F02AC0F0C02083000F80E0CA28C0802220
                                                                                                                                                                                                                                                                                              Function 00D0836F Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetFileAttributesW.KERNELBASE(00000000,00000000,00D085B2,?,00D1974F,00000000,00000000,?), ref: 00D08371
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AttributesFile
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3188754299-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 559dd1107c29e690812b1ba8b2cff892f80c7f809506302baf2d5cae035a84a8
                                                                                                                                                                                                                                                                                              • Instruction ID: 16e82046011e2fd0350c2ba7e595c09cfa9aef96c779d12ad942685757bb3bbb
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 559dd1107c29e690812b1ba8b2cff892f80c7f809506302baf2d5cae035a84a8
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 31A002A0321341DBA61C1B316F09B2F256DBDC2AD5705D65C7401D5160DA29C8515631
                                                                                                                                                                                                                                                                                              Function 00D0837D Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • RemoveDirectoryW.KERNELBASE(00000000,00D19704,?), ref: 00D0837E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: DirectoryRemove
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 597925465-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e76838c7d878259c318cb0517bc545c212e0915a09c2f44ddcbed040c8bfc116
                                                                                                                                                                                                                                                                                              • Instruction ID: ac99e8d043bb30626d6f534d79e2c175dce1356fb62bcc45200305840e464677
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e76838c7d878259c318cb0517bc545c212e0915a09c2f44ddcbed040c8bfc116
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6FA00260321341C7962C1B716F0960E255D6D425D1B0556586545D4160DA29C4505A21
                                                                                                                                                                                                                                                                                              Function 00D087B9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetCurrentDirectoryW.KERNELBASE(00000000,00D1DF7B,70235687), ref: 00D087BA
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CurrentDirectory
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1611563598-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 4c89c60315bffcca1d7bacd134c3faf68b7d2dd2cb08cfdb2267e01387ba35a3
                                                                                                                                                                                                                                                                                              • Instruction ID: 852c8c3a6a3fefe676917166ac0a4ac973c9c2362bdfb1902c3c0bb6a7d82d34
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4c89c60315bffcca1d7bacd134c3faf68b7d2dd2cb08cfdb2267e01387ba35a3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5AA00264629342DBCA2C1770992852A2D96574824131099686547D5390F935D8005730
                                                                                                                                                                                                                                                                                              Function 00D205E9 Relevance: 1.3, APIs: 1, Instructions: 70sleepCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • Sleep.KERNEL32(00000000,?,?), ref: 00D20682
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Sleep
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3472027048-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e62973f7e40c018e040c66603ed075c715c3c61c82e3b8ea48c46c706cd2b266
                                                                                                                                                                                                                                                                                              • Instruction ID: 553c9b1b74fa53975511bc868af7b1c03a2b8e242f91304c61fd907e33cd6d37
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e62973f7e40c018e040c66603ed075c715c3c61c82e3b8ea48c46c706cd2b266
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DB212A70C04218ABCF01EBA4E8429EEBF75EF69314F444199E84133292EB715B99DBB5
                                                                                                                                                                                                                                                                                              Function 00D118ED Relevance: 1.3, APIs: 1, Instructions: 50COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(70235687,?,?,?,00D39BA9,000000FF), ref: 00D1193A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1452528299-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 28aa73ac9c2ecdbd68905ea440002c1e976f7e5d228e00dc08a82450f11d02c6
                                                                                                                                                                                                                                                                                              • Instruction ID: c69ca4caed56b211577855cf1245fa087f309ab2d0f6782a95d9677405cc2dd4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 28aa73ac9c2ecdbd68905ea440002c1e976f7e5d228e00dc08a82450f11d02c6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 46118B7960420AEFDB14CF60E860BABB3B9FB45314F04452AE976A7290DB35E840CF70
                                                                                                                                                                                                                                                                                              Function 00D094C0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(?,70235687,?,00000000,00D39B8C,000000FF,?,00D09496,?,?,00D08BC5,?,00000000,00000001,00000003,02000000), ref: 00D094EC
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseHandle
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2962429428-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 89c61e8208ce4ffb8d5d201c4faf6bfd23d19e3de4af118d356133ed393de14b
                                                                                                                                                                                                                                                                                              • Instruction ID: b247e616e221cd9c89afb856f4c0ff36a95613ec1233bc0c7a442e9000000245
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 89c61e8208ce4ffb8d5d201c4faf6bfd23d19e3de4af118d356133ed393de14b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B8F0A031604646EFCB248F19DC51B52FBE8FB06B34F10072AE876D32D0E739D8018A64
                                                                                                                                                                                                                                                                                              Function 00D01295 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00D012E9), ref: 00D012A6
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AllocVirtual
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a19025b0df8d997efcbd66bc46c1af5041798c4df1c1615967f930ec71a5fa5f
                                                                                                                                                                                                                                                                                              • Instruction ID: 80865d71305786c7a5ac2b580e5fc396eb811d7d3adcb8860966fbb11b4951a5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a19025b0df8d997efcbd66bc46c1af5041798c4df1c1615967f930ec71a5fa5f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78B092B43A134065FE6803654D0BB6612004740B57F001058B309E80C4E6D054005128
                                                                                                                                                                                                                                                                                              Function 00D012AD Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • VirtualFree.KERNELBASE(?,00000000,00008000,00D012F8), ref: 00D012B9
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FreeVirtual
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e27186af8fe34c1d1505479781115a59b22a7a25618e1e2bc62ecfa950d647b3
                                                                                                                                                                                                                                                                                              • Instruction ID: 019dfdf52a126e9a6a5b5b232ba95286345cd8389b97a86b231fd5f3248710b3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e27186af8fe34c1d1505479781115a59b22a7a25618e1e2bc62ecfa950d647b3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62B011382A2300AAEE3C03200E0AB2A30002B00B02E2802083A02F80C08AA0A0008A28

                                                                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                                                                              Function 00D01C57 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 80libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetVersion.KERNEL32 ref: 00D01C6A
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00D01C80
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00D01C87
                                                                                                                                                                                                                                                                                              • GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00D01CAC
                                                                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00D01D2D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemVersion
                                                                                                                                                                                                                                                                                              • String ID: SetDefaultDllDirectories$kernel32.dll$userenv
                                                                                                                                                                                                                                                                                              • API String ID: 2515194075-1199472412
                                                                                                                                                                                                                                                                                              • Opcode ID: b253a6142d169c07bac4ff1d4b394562cf838db90bcce27f24451457fe7fb0a6
                                                                                                                                                                                                                                                                                              • Instruction ID: 983916b2e7437b89e4d966e93ae59d5dd36edad1770c0a04a6b84eb03a89dc7e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b253a6142d169c07bac4ff1d4b394562cf838db90bcce27f24451457fe7fb0a6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB2103396103459BE720EBA8A915BE6F3B4EF04704F185556E948EB290E670C984C7B4
                                                                                                                                                                                                                                                                                              Function 00D338B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,2000000B,00D33BC2,00000002,00000000,?,?,?,00D33BC2,?,00000000), ref: 00D33949
                                                                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,20001004,00D33BC2,00000002,00000000,?,?,?,00D33BC2,?,00000000), ref: 00D33972
                                                                                                                                                                                                                                                                                              • GetACP.KERNEL32(?,?,00D33BC2,?,00000000), ref: 00D33987
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: InfoLocale
                                                                                                                                                                                                                                                                                              • String ID: ACP$OCP
                                                                                                                                                                                                                                                                                              • API String ID: 2299586839-711371036
                                                                                                                                                                                                                                                                                              • Opcode ID: a15c09f4003f0097f5cb6c4b32f29b4bac7e5a918cd9d9d2dcf3e04c36c68441
                                                                                                                                                                                                                                                                                              • Instruction ID: 1df9e44b5cd1822cfdfc897dbb9866ab039579e221e93930f41b77d45b79f6e7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a15c09f4003f0097f5cb6c4b32f29b4bac7e5a918cd9d9d2dcf3e04c36c68441
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5721B322700205E7DB348F14CB01BA7B7A6AB94F64F5A8524E94AEB210E772DF40CB70
                                                                                                                                                                                                                                                                                              Function 00D33A8C Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2C71C: GetLastError.KERNEL32(?,?,00D26397,00D49388,0000000C), ref: 00D2C720
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2C71C: SetLastError.KERNEL32(00000000), ref: 00D2C7C2
                                                                                                                                                                                                                                                                                              • GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00D33B94
                                                                                                                                                                                                                                                                                              • IsValidCodePage.KERNEL32(00000000), ref: 00D33BD2
                                                                                                                                                                                                                                                                                              • IsValidLocale.KERNEL32(?,00000001), ref: 00D33BE5
                                                                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00D33C2D
                                                                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00D33C48
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 415426439-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 0c5ee5f9d92e5581395d0cc85be526448f59c6231f401dbb75ee4394e342bcbe
                                                                                                                                                                                                                                                                                              • Instruction ID: aff86ea3872ae799e09b317fa620a56fc6691691eb93305c0cecd3f3179c2b58
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c5ee5f9d92e5581395d0cc85be526448f59c6231f401dbb75ee4394e342bcbe
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6A518F71A00619ABDB10DFA9CE85BBEB7B8FF48700F084469F511EB191E770DA408B71
                                                                                                                                                                                                                                                                                              Function 00D33117 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2C71C: GetLastError.KERNEL32(?,?,00D26397,00D49388,0000000C), ref: 00D2C720
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2C71C: SetLastError.KERNEL32(00000000), ref: 00D2C7C2
                                                                                                                                                                                                                                                                                              • GetACP.KERNEL32(?,?,?,?,?,?,00D29A68,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00D331D6
                                                                                                                                                                                                                                                                                              • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00D29A68,?,?,?,00000055,?,-00000050,?,?), ref: 00D3320D
                                                                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00D33370
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$CodeInfoLocalePageValid
                                                                                                                                                                                                                                                                                              • String ID: utf8
                                                                                                                                                                                                                                                                                              • API String ID: 607553120-905460609
                                                                                                                                                                                                                                                                                              • Opcode ID: 2986727b01c4d1d276262867c550fb1d035b8bb1b25ecd6d7fdb2e8d3ba0549c
                                                                                                                                                                                                                                                                                              • Instruction ID: 0a348475ec2238ec368a6d999dfc34949632656448f32e5651d82d48ff88011d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2986727b01c4d1d276262867c550fb1d035b8bb1b25ecd6d7fdb2e8d3ba0549c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7B711971A00302AADB25AB74DD42BBB77A8EF55701F184529F946DB181FBB0EE44C770
                                                                                                                                                                                                                                                                                              Function 00D2162A Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00D21636
                                                                                                                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32 ref: 00D21702
                                                                                                                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D2171B
                                                                                                                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32(?), ref: 00D21725
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 254469556-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e3f7abc647f646e8cba6e378f5f3da518e406285c4e322307044bea49abf947e
                                                                                                                                                                                                                                                                                              • Instruction ID: 122163f8b59e53bb5ceb0e2fa167ab13853b475ed8f861dd5dc1801d7c5cb931
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e3f7abc647f646e8cba6e378f5f3da518e406285c4e322307044bea49abf947e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3231F979D0532CDBDB20DFA4D9497CDBBB8EF18304F1041AAE40DAB250EB749A848F55
                                                                                                                                                                                                                                                                                              Function 00D2239E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00D49C38,00000002,?,?,00D1E2A0,?,?,?,?,?,00D49C38), ref: 00D223B2
                                                                                                                                                                                                                                                                                              • FormatMessageA.KERNEL32(00001300,00000000,?,00D49C38,?,00000000,00000000,?,?,?,00D1E2A0,?,?,?,?,?), ref: 00D223D9
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FormatInfoLocaleMessage
                                                                                                                                                                                                                                                                                              • String ID: !x-sys-default-locale
                                                                                                                                                                                                                                                                                              • API String ID: 4235545615-2729719199
                                                                                                                                                                                                                                                                                              • Opcode ID: fe601e5727e814b62a64f87cb7616dd2f4d2bde253e08de400d2281bac34faa3
                                                                                                                                                                                                                                                                                              • Instruction ID: da243d0e5d6ae6e2d594f85f6746566046ac72a0172ff3fbe0705239afbfa6bb
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe601e5727e814b62a64f87cb7616dd2f4d2bde253e08de400d2281bac34faa3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08F03076114214FFEB149B94EC0AEBE7AACEB19754F004019F605E6150E6B0AE009B70
                                                                                                                                                                                                                                                                                              Function 00D0A419 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D0A406: GetCurrentProcess.KERNEL32(?,?,00D0A427), ref: 00D0A40B
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D0A406: GetProcessAffinityMask.KERNEL32(00000000), ref: 00D0A412
                                                                                                                                                                                                                                                                                              • GetSystemInfo.KERNEL32(?), ref: 00D0A43F
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Process$AffinityCurrentInfoMaskSystem
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3251479945-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 94cefba9ea2bda4c29dbd8ec9bb59ad16e1170a7e6a6b455398389d63e11da52
                                                                                                                                                                                                                                                                                              • Instruction ID: e4d890e049049e67a16930cb3bbb4b3bfb6c8ded478d36d44d79b46eca1d43c6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 94cefba9ea2bda4c29dbd8ec9bb59ad16e1170a7e6a6b455398389d63e11da52
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3FE0EC3590030D96CB04E7A8D48ABDDB7B8AB04308F444054D409A21D0EBB0D986C772
                                                                                                                                                                                                                                                                                              Function 00D22722 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D22728
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00D22736
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00D22747
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00D22758
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                                                                              • String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
                                                                                                                                                                                                                                                                                              • API String ID: 667068680-1247241052
                                                                                                                                                                                                                                                                                              • Opcode ID: f086fca649e933fa6d0cc6ccd0639ef48deea9d1833847a69edcc3ce7efa3286
                                                                                                                                                                                                                                                                                              • Instruction ID: 84c0f0680e8c2d7368d6abcd3020950e748d6104f0476c5ded0477444115c231
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f086fca649e933fa6d0cc6ccd0639ef48deea9d1833847a69edcc3ce7efa3286
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 41E0EC7A965350EF83257FB4BD0D8467AAAAB167517015011F901E2364D6B44404DBB1
                                                                                                                                                                                                                                                                                              Function 00D254FF Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • type_info::operator==.LIBVCRUNTIME ref: 00D2561E
                                                                                                                                                                                                                                                                                              • ___TypeMatch.LIBVCRUNTIME ref: 00D2572C
                                                                                                                                                                                                                                                                                              • _UnwindNestedFrames.LIBCMT ref: 00D2587E
                                                                                                                                                                                                                                                                                              • CallUnexpected.LIBVCRUNTIME ref: 00D25899
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                                                                                                                              • String ID: csm$csm$csm
                                                                                                                                                                                                                                                                                              • API String ID: 2751267872-393685449
                                                                                                                                                                                                                                                                                              • Opcode ID: dd31ebd1242f225dd0d3db718e762c4b1bab7e79f96079b5393b14ea1781d6d2
                                                                                                                                                                                                                                                                                              • Instruction ID: 3645b4d6d525b63ce212aebb9f760a462ef6a5e9e50d4b7ac92e11b9fbc59333
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dd31ebd1242f225dd0d3db718e762c4b1bab7e79f96079b5393b14ea1781d6d2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75B17B71800A29EFCF25DF94F840DAEBBB5EF24318B184159E8116B219D771DA51CFB1
                                                                                                                                                                                                                                                                                              Function 00D22538 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00D22581
                                                                                                                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 00D225AD
                                                                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00D225EC
                                                                                                                                                                                                                                                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D22609
                                                                                                                                                                                                                                                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00D22648
                                                                                                                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 00D22665
                                                                                                                                                                                                                                                                                              • LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D226A7
                                                                                                                                                                                                                                                                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D226CA
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ByteCharMultiStringWide$__alloca_probe_16
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2040435927-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2dda8609e34194473975d31d97b356c57ec188e27699f506cf496cabb9a026d8
                                                                                                                                                                                                                                                                                              • Instruction ID: e901e3b51b824a0bd0c88605e5d363dbab5a76985ac5a1d788c011e230d61fa7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2dda8609e34194473975d31d97b356c57ec188e27699f506cf496cabb9a026d8
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 98519D7250022ABBEF209FA4EC45FBB7BA9EF60759F184025F910E6150EB71CD108BB0
                                                                                                                                                                                                                                                                                              Function 00D22D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00D22D67
                                                                                                                                                                                                                                                                                              • ___except_validate_context_record.LIBVCRUNTIME ref: 00D22D6F
                                                                                                                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00D22DF8
                                                                                                                                                                                                                                                                                              • __IsNonwritableInCurrentImage.LIBCMT ref: 00D22E23
                                                                                                                                                                                                                                                                                              • _ValidateLocalCookies.LIBCMT ref: 00D22E78
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                                                                                                              • String ID: csm
                                                                                                                                                                                                                                                                                              • API String ID: 1170836740-1018135373
                                                                                                                                                                                                                                                                                              • Opcode ID: 10b74bb1639605e91990a3f37371089206a2d69be2a1af11f4590af5f029eef1
                                                                                                                                                                                                                                                                                              • Instruction ID: 2a048f5ba7accc00de5973f044184ef2302d1669b1e6b7c4e5a95e29c08d0355
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 10b74bb1639605e91990a3f37371089206a2d69be2a1af11f4590af5f029eef1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF41A734900228AFCF10DF68E884AAEBBB5EF55328F148155F814AB356D771DA15DBF0
                                                                                                                                                                                                                                                                                              Function 00D1A686 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D1A68D
                                                                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00D1A699
                                                                                                                                                                                                                                                                                              • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D1A6E0
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D21E15: _Yarn.LIBCPMT ref: 00D21E34
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D21E15: _Yarn.LIBCPMT ref: 00D21E58
                                                                                                                                                                                                                                                                                              • std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00D1A722
                                                                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00D1A75A
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: std::_$Locinfo::_LockitYarn$H_prolog3Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
                                                                                                                                                                                                                                                                                              • String ID: bad locale name
                                                                                                                                                                                                                                                                                              • API String ID: 2469272659-1405518554
                                                                                                                                                                                                                                                                                              • Opcode ID: 50000fb9a0b770aa40e4c239b25a6c89b7e65667b762a8de27829255b0e8d4d5
                                                                                                                                                                                                                                                                                              • Instruction ID: ed367a37163f529f1ba61454fe2b65fb4ff2ec954bf8e3649cb043824b0e71db
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 50000fb9a0b770aa40e4c239b25a6c89b7e65667b762a8de27829255b0e8d4d5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7E218332104614AFC724FB54E962BEAB3B4EF24720F10852EF456529D1EFB4AA48C674
                                                                                                                                                                                                                                                                                              Function 00D01005 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 16libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00D08DDB
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,FindFirstStreamW), ref: 00D08DE9
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,FindNextStreamW), ref: 00D08DFA
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                                                                                              • String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
                                                                                                                                                                                                                                                                                              • API String ID: 667068680-4044117955
                                                                                                                                                                                                                                                                                              • Opcode ID: b001f3407669a5733d683e5e289e6d7dddb6fa2e70991dcd296a9b46abd0afc3
                                                                                                                                                                                                                                                                                              • Instruction ID: 9576d4151ede259b667be038f332d14b786c644cf03cb80443a5fddb4005f581
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b001f3407669a5733d683e5e289e6d7dddb6fa2e70991dcd296a9b46abd0afc3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FED05EB9654340EF87049FADBC0E8167EB5EAE6B413000119B442E2364DB708201DB31
                                                                                                                                                                                                                                                                                              Function 00D1E54C Relevance: 9.1, APIs: 6, Instructions: 87COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • std::_Is_slash_oper::operator.LIBCPMT ref: 00D1E57B
                                                                                                                                                                                                                                                                                              • std::_Is_slash_oper::operator.LIBCPMT ref: 00D1E594
                                                                                                                                                                                                                                                                                              • std::_Is_slash_oper::operator.LIBCPMT ref: 00D1E5A7
                                                                                                                                                                                                                                                                                              • std::_Is_slash_oper::operator.LIBCPMT ref: 00D1E5B5
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Is_slash_oper::operatorstd::_
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2479866829-0
                                                                                                                                                                                                                                                                                              • Opcode ID: dab252306f3d2555b25769475c54a39b903c948c19ac60ed36fbb567f7ca02fc
                                                                                                                                                                                                                                                                                              • Instruction ID: 05edda4c1bd058f321401d5bd2edf672bd2ce9fe09719b7a103cec6823c98da1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dab252306f3d2555b25769475c54a39b903c948c19ac60ed36fbb567f7ca02fc
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B21C2A1A0022171EE349B99F8454FAB3AADE65B98B480829FCC5C7192ED30E8C1D231
                                                                                                                                                                                                                                                                                              Function 00D25191 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,00D25188,00D233E9,00D21807), ref: 00D2519F
                                                                                                                                                                                                                                                                                              • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D251AD
                                                                                                                                                                                                                                                                                              • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D251C6
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,00D25188,00D233E9,00D21807), ref: 00D25218
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3852720340-0
                                                                                                                                                                                                                                                                                              • Opcode ID: da2240db9639ab98448a496e4a4467a843ac8919b829e6345a8e9ed92a96339e
                                                                                                                                                                                                                                                                                              • Instruction ID: 0959d520051d8611a4520ce83ed5fd19be178e584c3c4bf686a4dd2fbe5f50fc
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: da2240db9639ab98448a496e4a4467a843ac8919b829e6345a8e9ed92a96339e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB01B136219B35DEAB252AB47C99E2A3654EF7277C724032AF464942E5EF218C109178
                                                                                                                                                                                                                                                                                              Function 00D1CA91 Relevance: 9.1, APIs: 6, Instructions: 52COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D1CA98
                                                                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00D1CAA2
                                                                                                                                                                                                                                                                                              • int.LIBCPMT ref: 00D1CAB9
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1A795: std::_Lockit::_Lockit.LIBCPMT ref: 00D1A7A6
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D1A795: std::_Lockit::~_Lockit.LIBCPMT ref: 00D1A7C0
                                                                                                                                                                                                                                                                                              • std::_Facet_Register.LIBCPMT ref: 00D1CAF9
                                                                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00D1CB1F
                                                                                                                                                                                                                                                                                              • Concurrency::cancel_current_task.LIBCPMT ref: 00D1CB2C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 55977855-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2b84f49f2c1e1b66fe5585443cd944d764e29a1776c999c96e99769490d1b2a4
                                                                                                                                                                                                                                                                                              • Instruction ID: bfddc30577bc0691383567765844d1ecab5114e4d5a30bbbe79e9faee58fa6e9
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b84f49f2c1e1b66fe5585443cd944d764e29a1776c999c96e99769490d1b2a4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BD118E35A5062AAFCB05FFA4E812AEE7775FF10354F144508F021AB292EF349A85C7B1
                                                                                                                                                                                                                                                                                              Function 00D2B849 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe, xrefs: 00D2B865
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID: C:\Users\user\AppData\Local\Temp\OperaGXInstaller\OperaGXInstaller.exe
                                                                                                                                                                                                                                                                                              • API String ID: 0-598421954
                                                                                                                                                                                                                                                                                              • Opcode ID: a59cbf8498b65dcbda8a18216aec3fd3c11f7da62bee94f52f8af18345d6ce16
                                                                                                                                                                                                                                                                                              • Instruction ID: ad1ef52be241f6c100837f000b39b41e8ccbb2828834cf94c7d39fcbe29c9ead
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a59cbf8498b65dcbda8a18216aec3fd3c11f7da62bee94f52f8af18345d6ce16
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7821C631600239AFDB20AF61EC8086AB7ADEF2037C7144917FA99D7151D7B1EC908BB0
                                                                                                                                                                                                                                                                                              Function 00D285AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,70235687,?,?,00000000,00D39BA9,000000FF,?,00D28588,00000002,?,00D2855C,00D2B51B), ref: 00D285E1
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D285F3
                                                                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,00000000,00D39BA9,000000FF,?,00D28588,00000002,?,00D2855C,00D2B51B), ref: 00D28615
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                                                                              • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                                                                              • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                                                                              • Opcode ID: 0ec55d9ff8f640c8ab4b11ab9467ddce633f097c506f9976ceee88ef172ddbce
                                                                                                                                                                                                                                                                                              • Instruction ID: 23bf16505091d9ea0650351d097325c0fd8755caab3610471719bab594e7ebd4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0ec55d9ff8f640c8ab4b11ab9467ddce633f097c506f9976ceee88ef172ddbce
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2D017C72914669AFDB119B90EC09BABBBB9FB44B15F040525B811F2290DB749804DAA4
                                                                                                                                                                                                                                                                                              Function 00D34B72 Relevance: 7.7, APIs: 5, Instructions: 197COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 00D34BF7
                                                                                                                                                                                                                                                                                              • __alloca_probe_16.LIBCMT ref: 00D34CC0
                                                                                                                                                                                                                                                                                              • __freea.LIBCMT ref: 00D34D27
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2C333: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D0128B,?,00D012CB), ref: 00D2C365
                                                                                                                                                                                                                                                                                              • __freea.LIBCMT ref: 00D34D3A
                                                                                                                                                                                                                                                                                              • __freea.LIBCMT ref: 00D34D47
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __freea$__alloca_probe_16$AllocateHeap
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1423051803-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e37657f2463151f480cbc77d25e645b13c2927d7cb594b00f1b1c6eb10171644
                                                                                                                                                                                                                                                                                              • Instruction ID: be75da11beb2f1aa24395b94cce91d9f7a6df7e2efe90786c14344f2a731c6b0
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e37657f2463151f480cbc77d25e645b13c2927d7cb594b00f1b1c6eb10171644
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D851C472600216AFEF219F60EC81EBB7AA9EF44714F190429FD04DB210EB78EC50C6B0
                                                                                                                                                                                                                                                                                              Function 00D21D17 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3.LIBCMT ref: 00D21D1E
                                                                                                                                                                                                                                                                                              • std::_Lockit::_Lockit.LIBCPMT ref: 00D21D29
                                                                                                                                                                                                                                                                                              • std::_Lockit::~_Lockit.LIBCPMT ref: 00D21D97
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D21E7A: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D21E92
                                                                                                                                                                                                                                                                                              • std::locale::_Setgloballocale.LIBCPMT ref: 00D21D44
                                                                                                                                                                                                                                                                                              • _Yarn.LIBCPMT ref: 00D21D5A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1088826258-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 696dbc96fd1b536acad19d89e7a9d971060ad3192dc83bd24756109fedbb7092
                                                                                                                                                                                                                                                                                              • Instruction ID: 2f8b89114593c6dc5c7a7e1afeb6926dec5bd5208a6a490fd69de1ba1cfa0530
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 696dbc96fd1b536acad19d89e7a9d971060ad3192dc83bd24756109fedbb7092
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75017C79A016219BC705EF60E865A7D7B72FFA5384F188009E811A7391CB74AA03CBF5
                                                                                                                                                                                                                                                                                              Function 00D1E462 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __EH_prolog3_GS.LIBCMT ref: 00D1E469
                                                                                                                                                                                                                                                                                              • ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00D1E4B1
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2240F: MultiByteToWideChar.KERNEL32(?,00000008,00000000,?,00000001,?,?,?,00D1E4B6,?,00000000,?,00000000,00000000,00000014,00D20867), ref: 00D22424
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2240F: GetLastError.KERNEL32(?,?,00D1E4B6,?,00000000,?,00000000,00000000,00000014,00D20867,00000000,?,?,?,?), ref: 00D22430
                                                                                                                                                                                                                                                                                              • ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 00D1E4E8
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ___std_fs_convert_narrow_to_wide@20$ByteCharErrorH_prolog3_LastMultiWide
                                                                                                                                                                                                                                                                                              • String ID: /
                                                                                                                                                                                                                                                                                              • API String ID: 627721728-2043925204
                                                                                                                                                                                                                                                                                              • Opcode ID: 7fcf36a6a280dac1661446ff376148b674430f3c0a20ff6de078f0a80930780a
                                                                                                                                                                                                                                                                                              • Instruction ID: 84f8772bab24c64105745197a84a75d240c126f513535b17bc1440d965f3f128
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7fcf36a6a280dac1661446ff376148b674430f3c0a20ff6de078f0a80930780a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2511CAB09003047ADB14BB756846AFFB7B9DFD0754F148128B90997182DE748DD682B1
                                                                                                                                                                                                                                                                                              Function 00D26183 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00D26134,00000000,?,00D4D1B4,?,?,?,00D262D7,00000004,InitializeCriticalSectionEx,00D3DD8C,InitializeCriticalSectionEx), ref: 00D26190
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00D26134,00000000,?,00D4D1B4,?,?,?,00D262D7,00000004,InitializeCriticalSectionEx,00D3DD8C,InitializeCriticalSectionEx,00000000,?,00D26056), ref: 00D2619A
                                                                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00D261C2
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                                                                              • API String ID: 3177248105-2084034818
                                                                                                                                                                                                                                                                                              • Opcode ID: eab52a973aea4251ec8602edc4662c42dbfe4a352832b7785cb640e1e062e405
                                                                                                                                                                                                                                                                                              • Instruction ID: 3df376674f5bd73cddc96b150e0311c5ef35662453cd604d8ead223fb93e2f89
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: eab52a973aea4251ec8602edc4662c42dbfe4a352832b7785cb640e1e062e405
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DAE04830250314F7DB211F61FC06B5D7A55AF20B99F144020F90DF41E1D761E8259679
                                                                                                                                                                                                                                                                                              Function 00D2D9CA Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetConsoleOutputCP.KERNEL32(70235687,00000000,00000000,0000000C), ref: 00D2DA2D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D30E07: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D34D1D,?,00000000,-00000008), ref: 00D30E68
                                                                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D2DC7F
                                                                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D2DCC5
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00D2DD68
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2112829910-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 501b13b4393767275792b9f74ddb7fbb61b3c8111750933db24b4dec26085129
                                                                                                                                                                                                                                                                                              • Instruction ID: d469c04db1eeb857295766ad0253e41659785562dc96fff13434c69895e4fb49
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 501b13b4393767275792b9f74ddb7fbb61b3c8111750933db24b4dec26085129
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54D1ABB5D046589FCF14CFA8E8809ADBBB6FF59308F28416AE455EB351D730E902CB60
                                                                                                                                                                                                                                                                                              Function 00D252A8 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AdjustPointer
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1740715915-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 9e8ba059fd741d0e6e19020decc16def5ed9a8ba1a2891c7e1c5f7490bf0d487
                                                                                                                                                                                                                                                                                              • Instruction ID: 2e1adcd1a2db01aae0c5d50732d607d83866371dc3285082db607db3f5ed326b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e8ba059fd741d0e6e19020decc16def5ed9a8ba1a2891c7e1c5f7490bf0d487
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0451D272601A22AFDB29DF14F841F7AB3A5EF20759F184129ED0187698E7B1ED50CB70
                                                                                                                                                                                                                                                                                              Function 00D1E0B8 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D2233D: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00D1E0CB), ref: 00D2235B
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D22326: QueryPerformanceCounter.KERNEL32(?,?,?,?,00D1E0D7), ref: 00D2232F
                                                                                                                                                                                                                                                                                              • __alldvrm.LIBCMT ref: 00D1E120
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D1E143
                                                                                                                                                                                                                                                                                              • __alldvrm.LIBCMT ref: 00D1E159
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D1E17B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: PerformanceQueryUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@$CounterFrequency
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1598812886-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b516831fccd58a107def31426e731796a7362df067531a45f8cb81dd822c5a24
                                                                                                                                                                                                                                                                                              • Instruction ID: 849941300736fd782250be5da8ded095ea05a3117bd678fe7defd4b4dc411895
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b516831fccd58a107def31426e731796a7362df067531a45f8cb81dd822c5a24
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8B21BFB6E003197ADB24EBA55C96EFFBBBDDFC0714F104029B90AB3241E9705D408AB4
                                                                                                                                                                                                                                                                                              Function 00D2FCA8 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D30E07: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D34D1D,?,00000000,-00000008), ref: 00D30E68
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00D2FD0C
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 00D2FD13
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?), ref: 00D2FD4D
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 00D2FD54
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1913693674-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7616eb6efb0a26665f113207816a1111098057b925c91a5fd73d55334ffb3efe
                                                                                                                                                                                                                                                                                              • Instruction ID: 1d12af226e683cae2786bb646c9b8e01c2aa568549916b377f8f007ac62206db
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7616eb6efb0a26665f113207816a1111098057b925c91a5fd73d55334ffb3efe
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9121A771600329AFDB20AF65F88096BB7B9FF20368714893AF955D7251D770EC509BB0
                                                                                                                                                                                                                                                                                              Function 00D30EAA Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetEnvironmentStringsW.KERNEL32 ref: 00D30EB2
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D30E07: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D34D1D,?,00000000,-00000008), ref: 00D30E68
                                                                                                                                                                                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D30EEA
                                                                                                                                                                                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D30F0A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 158306478-0
                                                                                                                                                                                                                                                                                              • Opcode ID: f60ebbb53ac980a480c95a4e5a3deee956283c731d285b0dd4ecec2c01e5375c
                                                                                                                                                                                                                                                                                              • Instruction ID: bc3e314d206eba14bc3933a5079b81ce5068e6f7f723fa3486a19aff9c3ca86a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f60ebbb53ac980a480c95a4e5a3deee956283c731d285b0dd4ecec2c01e5375c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4A11D6F2A1561AFEA72127B6ACAAC7F7E6CDE98398B140464F805F1101FE30CD0182B5
                                                                                                                                                                                                                                                                                              Function 00D08E25 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D08D01: FindClose.KERNELBASE(?,?,00D08D4A,?,00000000,?), ref: 00D08D0B
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000078,?,00000000,00000000), ref: 00D08E57
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,?,00000000,00000000), ref: 00D08E72
                                                                                                                                                                                                                                                                                              • FindFirstStreamW.KERNELBASE(00000001,00000000,?,00000000), ref: 00D08E84
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00000000,00000000), ref: 00D08E91
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$Find$CloseFirstStream
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4071060300-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 589de8308e5241f4d82e1eb74e8304b452f66277ff26cbf51d090c5d7291274a
                                                                                                                                                                                                                                                                                              • Instruction ID: da85a94b8808f1a5998e99f01a7b8250735b6b5d41c4bd3ecab7714fe44e6de1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 589de8308e5241f4d82e1eb74e8304b452f66277ff26cbf51d090c5d7291274a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8701F535600308DBCB30AF74DC497A97764EB16724F244A55F599D72D1CF319944EB30
                                                                                                                                                                                                                                                                                              Function 00D37BAA Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00D36209,00000000,00000001,?,0000000C,?,00D2DDBC,0000000C,00000000,00000000), ref: 00D37BC1
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,00D36209,00000000,00000001,?,0000000C,?,00D2DDBC,0000000C,00000000,00000000,0000000C,0000000C,?,00D2E399,?), ref: 00D37BCD
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D37B93: CloseHandle.KERNEL32(FFFFFFFE,00D37BDD,?,00D36209,00000000,00000001,?,0000000C,?,00D2DDBC,0000000C,00000000,00000000,0000000C,0000000C), ref: 00D37BA3
                                                                                                                                                                                                                                                                                              • ___initconout.LIBCMT ref: 00D37BDD
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D37B55: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00D37B84,00D361F6,0000000C,?,00D2DDBC,0000000C,00000000,00000000,0000000C), ref: 00D37B68
                                                                                                                                                                                                                                                                                              • WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00D36209,00000000,00000001,?,0000000C,?,00D2DDBC,0000000C,00000000,00000000,0000000C), ref: 00D37BF2
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2744216297-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 94fb6c754b1f9f54145802ab00f3fe1a03f4d4d2619dae0060ecb1afd9ed7d75
                                                                                                                                                                                                                                                                                              • Instruction ID: 7fcbd995d43e069fc80c44d6f9eb02e970fab97cea55ae8dfdc70be14ac2125b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 94fb6c754b1f9f54145802ab00f3fe1a03f4d4d2619dae0060ecb1afd9ed7d75
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C8F0AC3B554669BBCF321FA5DC08D997F36EF197B1F045410FA19D6221D632C860ABB0
                                                                                                                                                                                                                                                                                              Function 00D17527 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 162COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID: Unknown error$Unknown warning
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-4291957651
                                                                                                                                                                                                                                                                                              • Opcode ID: 6982be76ebee8bc4936cd5e4b8bed0d86640235804539499be2bbccc6293e03b
                                                                                                                                                                                                                                                                                              • Instruction ID: afbf90c41b1955c8f08b739d816587fea83345879d8bfcb0baeab637cde697a8
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6982be76ebee8bc4936cd5e4b8bed0d86640235804539499be2bbccc6293e03b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E8518E70904B04ABDB25DFA8D894ADEB7F5FF18304F54482DE586936A1EF74A984CB30
                                                                                                                                                                                                                                                                                              Function 00D258A4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • EncodePointer.KERNEL32(00000000,?), ref: 00D258C9
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: EncodePointer
                                                                                                                                                                                                                                                                                              • String ID: MOC$RCC
                                                                                                                                                                                                                                                                                              • API String ID: 2118026453-2084237596
                                                                                                                                                                                                                                                                                              • Opcode ID: 1d6f782236e61fd6ca853e43abe2d7ce338f88ddce6f3d63fb76b990e7376560
                                                                                                                                                                                                                                                                                              • Instruction ID: c9aa2e6abebf3de451bf34c61b36ce02d9cb90dbe6a8b17a7e76ded5c4489721
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1d6f782236e61fd6ca853e43abe2d7ce338f88ddce6f3d63fb76b990e7376560
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 49419A31900619EFDF15DF94EC81EAEBBB6FF18318F184059F90866225D33199A0DF60
                                                                                                                                                                                                                                                                                              Function 00D1EAFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog3
                                                                                                                                                                                                                                                                                              • String ID: %%C$%%S
                                                                                                                                                                                                                                                                                              • API String ID: 431132790-1134302098
                                                                                                                                                                                                                                                                                              • Opcode ID: 4a6c853681c8b51825121f42b24887601825860a2cb70e8b7d19d3c5236d12d1
                                                                                                                                                                                                                                                                                              • Instruction ID: 9876cabf04f8aab05e78309e41342cc3293cdc431aee186dda58529768f4ae9d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4a6c853681c8b51825121f42b24887601825860a2cb70e8b7d19d3c5236d12d1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 02213E74D04248EACB05FBA0C562AEDBBB4EF25300F500099B556772C2DE65AF49DAB1
                                                                                                                                                                                                                                                                                              Function 00D0C8BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __aulldiv
                                                                                                                                                                                                                                                                                              • String ID: 3333
                                                                                                                                                                                                                                                                                              • API String ID: 3732870572-2924271548
                                                                                                                                                                                                                                                                                              • Opcode ID: c0575dcc85efdda72f897d78d55e77028e17041725bf866b8b6e5601d9d9548f
                                                                                                                                                                                                                                                                                              • Instruction ID: e536701511388a022c0ee7b735f51f3124ceb11b407609210763f11cfc1a371c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c0575dcc85efdda72f897d78d55e77028e17041725bf866b8b6e5601d9d9548f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CAF09632350308BADB145A5DDC06BAEBB99C780771F08C026B74C9E1E0D5B08D008BA5
                                                                                                                                                                                                                                                                                              Function 00D1A26C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • std::_Xinvalid_argument.LIBCPMT ref: 00D1A271
                                                                                                                                                                                                                                                                                                • Part of subcall function 00D21B04: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D21B10
                                                                                                                                                                                                                                                                                              • std::exception::exception.LIBCONCRT ref: 00D1A288
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 00000003.00000002.3293367939.0000000000D01000.00000020.00000001.01000000.00000008.sdmp, Offset: 00D00000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293279662.0000000000D00000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3293558584.0000000000D3C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3294775771.0000000000D4B000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 00000003.00000002.3295339179.0000000000D50000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_d00000_OperaGXInstaller.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Xinvalid_argumentstd::_std::exception::exceptionstd::invalid_argument::invalid_argument
                                                                                                                                                                                                                                                                                              • String ID: string too long
                                                                                                                                                                                                                                                                                              • API String ID: 1004629840-2556327735
                                                                                                                                                                                                                                                                                              • Opcode ID: 534d2fcbfb78b12e50b08d7047dd0b2886d6a7f04d9f12cac6c6f563fddeec80
                                                                                                                                                                                                                                                                                              • Instruction ID: 14146220240cadddfc65d795c1f3d1650be45719f083df9f7673c02f1b59a8cf
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 534d2fcbfb78b12e50b08d7047dd0b2886d6a7f04d9f12cac6c6f563fddeec80
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 45D012717041293B42047B9CB802CDEB69DDF65765B10413AFA08D7746DFB16D4087F9

                                                                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                                                                              Execution Coverage:18.3%
                                                                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                                              Signature Coverage:1.5%
                                                                                                                                                                                                                                                                                              Total number of Nodes:1763
                                                                                                                                                                                                                                                                                              Total number of Limit Nodes:17
                                                                                                                                                                                                                                                                                              execution_graph 8182 409a10 8185 4096a0 8182->8185 8184 409a5c 8186 4096b5 8185->8186 8187 4099fa 8185->8187 8186->8187 8210 40ce92 8186->8210 8187->8184 8190 4096d3 8190->8184 8191 40ce92 49 API calls 8192 4096ee 8191->8192 8192->8190 8193 40ce92 49 API calls 8192->8193 8194 409701 8193->8194 8194->8190 8195 40ce92 49 API calls 8194->8195 8196 409717 8195->8196 8197 40971b 8196->8197 8216 40d0b7 8196->8216 8197->8184 8199 409741 8199->8184 8200 40973d 8200->8199 8222 409520 8200->8222 8202 4097af 8203 4099c6 8202->8203 8205 4099b3 8202->8205 8208 40ced6 6 API calls 8202->8208 8209 40d1a6 118 API calls 8202->8209 8226 409570 8202->8226 8233 40d18a 8203->8233 8205->8184 8206 4099cd 8206->8184 8208->8202 8209->8202 8211 40cea1 8210->8211 8212 4096cf 8211->8212 8237 40ce59 8211->8237 8212->8190 8212->8191 8217 40d0c6 8216->8217 8219 40d0e0 8217->8219 8456 40d066 8217->8456 8219->8200 8221 402765 48 API calls 8221->8219 8223 409529 8222->8223 8225 40956a 8223->8225 8459 40cf3f 8223->8459 8225->8202 8229 4095d4 8226->8229 8230 409588 8226->8230 8227 4095b2 8227->8202 8228 409600 8228->8202 8229->8228 8231 40cf3f 6 API calls 8229->8231 8230->8227 8232 40cf3f 6 API calls 8230->8232 8231->8228 8232->8227 8234 40d18f 8233->8234 8235 40d1a2 8234->8235 8498 40d0f9 8234->8498 8235->8206 8245 401d26 8237->8245 8240 402765 8248 4026fb 8240->8248 8243 402773 8243->8212 8244 402774 VirtualAlloc 8244->8212 8246 401d2d VirtualFree 8245->8246 8247 401d3e 8245->8247 8246->8247 8247->8240 8249 40270b 8248->8249 8255 402707 8248->8255 8250 40271b GlobalMemoryStatusEx 8249->8250 8249->8255 8251 402729 8250->8251 8250->8255 8251->8255 8256 4021b3 8251->8256 8255->8243 8255->8244 8257 4021ca 8256->8257 8258 4021f1 8257->8258 8259 4021fb GetLastError wsprintfW GetEnvironmentVariableW GetLastError 8257->8259 8276 408d65 8258->8276 8260 402233 ??2@YAPAXI GetEnvironmentVariableW 8259->8260 8261 4022ab SetLastError 8259->8261 8263 402294 ??3@YAXPAX 8260->8263 8264 402262 GetLastError 8260->8264 8261->8258 8262 4022c2 8261->8262 8265 4022e1 lstrlenA ??2@YAPAXI 8262->8265 8285 40215d 8262->8285 8272 402297 8263->8272 8264->8263 8266 402268 8264->8266 8269 402312 GetLocaleInfoW 8265->8269 8270 40234c MultiByteToWideChar 8265->8270 8271 402272 lstrcmpiW 8266->8271 8266->8272 8269->8270 8274 402339 _wtol 8269->8274 8270->8258 8271->8263 8275 402281 ??3@YAXPAX 8271->8275 8272->8261 8273 4022d7 8273->8265 8274->8270 8275->8272 8292 407cb6 8276->8292 8279 408d8a IsBadReadPtr 8281 408d9c 8279->8281 8297 407d17 8281->8297 8284 408dcd 8284->8255 8286 402167 GetUserDefaultUILanguage 8285->8286 8287 4021ab 8285->8287 8288 402184 8286->8288 8289 402188 GetSystemDefaultUILanguage 8286->8289 8287->8273 8288->8273 8289->8287 8290 402194 GetSystemDefaultLCID 8289->8290 8290->8287 8291 4021a4 8290->8291 8291->8287 8310 401484 8292->8310 8295 407d13 IsWindow 8295->8279 8295->8281 8296 407cef GetSystemMetrics GetSystemMetrics 8296->8295 8298 407d26 8297->8298 8299 407d8a 8297->8299 8298->8299 8318 40279d 8298->8318 8309 407a8a ??3@YAXPAX 8299->8309 8301 407d37 8302 40279d 2 API calls 8301->8302 8303 407d42 8302->8303 8322 404224 8303->8322 8306 404224 20 API calls 8307 407d54 ??3@YAXPAX ??3@YAXPAX 8306->8307 8307->8299 8309->8284 8313 40119e 8310->8313 8314 4011ea 8313->8314 8315 4011ac ??2@YAPAXI 8313->8315 8314->8295 8314->8296 8315->8314 8316 4011cd ??3@YAXPAX 8315->8316 8316->8314 8319 4027b4 8318->8319 8320 40119e 2 API calls 8319->8320 8321 4027bf 8320->8321 8321->8301 8329 402b9d 8322->8329 8326 40423c 8365 4041f0 8326->8365 8330 401484 2 API calls 8329->8330 8331 402bab 8330->8331 8332 402bbb ExpandEnvironmentStringsW 8331->8332 8333 40119e 2 API calls 8331->8333 8334 402bd4 ??3@YAXPAX 8332->8334 8335 402bdf 8332->8335 8333->8332 8336 402c16 8334->8336 8376 4027d6 8335->8376 8342 403ee8 8336->8342 8339 402bfa 8380 4013d5 8339->8380 8341 402c0e ??3@YAXPAX 8341->8336 8343 401484 2 API calls 8342->8343 8344 403ef6 8343->8344 8345 4013d5 2 API calls 8344->8345 8346 403f01 8345->8346 8384 4027ee 8346->8384 8348 403f0e 8349 40279d 2 API calls 8348->8349 8350 403f1b 8349->8350 8388 403e6d 8350->8388 8353 4013d5 2 API calls 8354 403f3f 8353->8354 8355 4027ee 2 API calls 8354->8355 8356 403f4c 8355->8356 8357 40279d 2 API calls 8356->8357 8358 403f59 8357->8358 8359 403e6d 3 API calls 8358->8359 8360 403f69 ??3@YAXPAX 8359->8360 8361 40279d 2 API calls 8360->8361 8362 403f80 8361->8362 8363 403e6d 3 API calls 8362->8363 8364 403f8f ??3@YAXPAX ??3@YAXPAX 8363->8364 8364->8326 8366 402b9d 6 API calls 8365->8366 8367 4041fb 8366->8367 8405 403fa3 8367->8405 8369 404208 8428 40405e 8369->8428 8371 404213 8451 404119 8371->8451 8373 404219 8374 402b9d 6 API calls 8373->8374 8375 40421f 8374->8375 8375->8306 8377 4027e2 8376->8377 8378 4027e8 ExpandEnvironmentStringsW 8376->8378 8379 40119e 2 API calls 8377->8379 8378->8339 8379->8378 8381 4013e1 8380->8381 8383 4013f3 8380->8383 8382 40119e 2 API calls 8381->8382 8382->8383 8383->8341 8385 4027fb 8384->8385 8393 40140b 8385->8393 8387 402806 8387->8348 8389 403e7f ??3@YAXPAX 8388->8389 8391 403e83 8388->8391 8389->8353 8391->8389 8397 402a04 8391->8397 8401 40332f 8391->8401 8394 40144f 8393->8394 8395 40141f 8393->8395 8394->8387 8396 40119e ??2@YAPAXI ??3@YAXPAX 8395->8396 8396->8394 8398 402a1a 8397->8398 8399 402a2e 8398->8399 8400 4025d1 memmove 8398->8400 8399->8391 8400->8399 8402 40333e 8401->8402 8403 403357 8402->8403 8404 402abc ??2@YAPAXI ??3@YAXPAX memmove 8402->8404 8403->8391 8404->8403 8406 401484 2 API calls 8405->8406 8407 403fb1 8406->8407 8408 4013d5 2 API calls 8407->8408 8409 403fbc 8408->8409 8410 4027ee 2 API calls 8409->8410 8411 403fc9 8410->8411 8412 40279d 2 API calls 8411->8412 8413 403fd6 8412->8413 8414 403e6d 3 API calls 8413->8414 8415 403fe6 ??3@YAXPAX 8414->8415 8416 4013d5 2 API calls 8415->8416 8417 403ffa 8416->8417 8418 4027ee 2 API calls 8417->8418 8419 404007 8418->8419 8420 40279d 2 API calls 8419->8420 8421 404014 8420->8421 8422 403e6d 3 API calls 8421->8422 8423 404024 ??3@YAXPAX 8422->8423 8424 40279d 2 API calls 8423->8424 8425 40403b 8424->8425 8426 403e6d 3 API calls 8425->8426 8427 40404a ??3@YAXPAX ??3@YAXPAX 8426->8427 8427->8369 8429 401484 2 API calls 8428->8429 8430 40406c 8429->8430 8431 4013d5 2 API calls 8430->8431 8432 404077 8431->8432 8433 4027ee 2 API calls 8432->8433 8434 404084 8433->8434 8435 40279d 2 API calls 8434->8435 8436 404091 8435->8436 8437 403e6d 3 API calls 8436->8437 8438 4040a1 ??3@YAXPAX 8437->8438 8439 4013d5 2 API calls 8438->8439 8440 4040b5 8439->8440 8441 4027ee 2 API calls 8440->8441 8442 4040c2 8441->8442 8443 40279d 2 API calls 8442->8443 8444 4040cf 8443->8444 8445 403e6d 3 API calls 8444->8445 8446 4040df ??3@YAXPAX 8445->8446 8447 40279d 2 API calls 8446->8447 8448 4040f6 8447->8448 8449 403e6d 3 API calls 8448->8449 8450 404105 ??3@YAXPAX ??3@YAXPAX 8449->8450 8450->8371 8452 40279d 2 API calls 8451->8452 8453 40412c 8452->8453 8454 403e6d 3 API calls 8453->8454 8455 40413d ??3@YAXPAX 8454->8455 8455->8373 8457 401d26 VirtualFree 8456->8457 8458 40d070 8457->8458 8458->8221 8462 40ced6 8459->8462 8463 40cee4 8462->8463 8464 40cee8 8462->8464 8463->8223 8468 40cf7d 8464->8468 8466 40cf0d _CxxThrowException 8466->8463 8469 40cfa2 8468->8469 8470 40cf08 8469->8470 8472 40d02a 8469->8472 8470->8463 8470->8466 8475 40cfdf EnterCriticalSection 8472->8475 8474 40d04e 8474->8470 8481 40c5fe 8475->8481 8477 40d006 LeaveCriticalSection 8477->8474 8482 40c607 8481->8482 8483 40c60e 8481->8483 8482->8477 8487 40c5ca 8482->8487 8491 40beb6 SetFilePointer 8483->8491 8488 40c5e2 8487->8488 8489 40c58e GetLastError 8488->8489 8490 40c5f9 8489->8490 8490->8477 8492 40bedf GetLastError 8491->8492 8493 40bee9 8491->8493 8492->8493 8494 40c58e 8493->8494 8495 40c595 8494->8495 8496 40c598 GetLastError 8494->8496 8495->8482 8497 40c5a2 8496->8497 8497->8482 8499 40d10d 8498->8499 8500 40d132 8499->8500 8501 40d11e memmove 8499->8501 8502 40d14d 8500->8502 8507 40c030 SetFileTime 8500->8507 8508 40127e 8500->8508 8514 40be4b 8500->8514 8517 40efb4 8500->8517 8501->8500 8502->8234 8507->8502 8509 401292 8508->8509 8512 401286 8508->8512 8510 4012af 8509->8510 8523 40c04d 8509->8523 8510->8512 8513 4012bc SetFileAttributesW 8510->8513 8512->8502 8513->8512 8515 40be55 CloseHandle 8514->8515 8516 40be60 8514->8516 8515->8516 8516->8502 8520 40efc0 8517->8520 8518 40f06d 8518->8502 8520->8518 8521 40ef75 112 API calls 8520->8521 8527 412878 8520->8527 8531 40ee54 8520->8531 8521->8520 8526 40c030 SetFileTime 8523->8526 8525 40c05a 8525->8510 8526->8525 8528 412889 8527->8528 8529 412899 8527->8529 8536 40c662 8528->8536 8529->8520 8532 40ee6e 8531->8532 8544 401841 8532->8544 8607 40bfe5 8532->8607 8533 40eea2 8533->8520 8541 40c05d 8536->8541 8538 40c67b 8539 40c58e GetLastError 8538->8539 8540 40c69a 8539->8540 8540->8529 8542 40c06b 8541->8542 8543 40c06e WriteFile 8541->8543 8542->8543 8543->8538 8545 40185d 8544->8545 8551 401853 8544->8551 8610 40f78d _EH_prolog 8545->8610 8547 40188a 8654 40c125 8547->8654 8548 401484 2 API calls 8550 4018a3 8548->8550 8552 401b7d ??3@YAXPAX 8550->8552 8553 4018b8 8550->8553 8551->8533 8557 40c125 VariantClear 8552->8557 8636 40139c 8553->8636 8556 4018c3 8640 40157d 8556->8640 8557->8551 8560 4013d5 2 API calls 8561 4018e2 ??3@YAXPAX 8560->8561 8562 401b43 ??3@YAXPAX 8561->8562 8567 4018f4 8561->8567 8564 40c125 VariantClear 8562->8564 8564->8551 8565 401915 8566 40c125 VariantClear 8565->8566 8568 40191d ??3@YAXPAX 8566->8568 8567->8565 8569 40197f 8567->8569 8570 401940 8567->8570 8568->8547 8572 4019a4 8569->8572 8573 4019bd 8569->8573 8571 40c125 VariantClear 8570->8571 8574 401952 ??3@YAXPAX 8571->8574 8575 40c125 VariantClear 8572->8575 8576 4019c5 8573->8576 8577 4019df GetLocalTime SystemTimeToFileTime 8573->8577 8574->8547 8578 4019ac ??3@YAXPAX 8575->8578 8576->8570 8579 401a13 8576->8579 8580 4019fc 8576->8580 8577->8576 8578->8547 8645 4033b3 GetFileAttributesW 8579->8645 8658 40371d lstrlenW 8580->8658 8584 401b4f GetLastError 8584->8562 8585 401a33 ??2@YAPAXI 8587 401a3f 8585->8587 8586 401b45 8586->8584 8682 40c019 8587->8682 8590 401b2a 8594 40c125 VariantClear 8590->8594 8591 401a7a GetLastError 8685 40136a 8591->8685 8593 401a8c 8595 40371d 88 API calls 8593->8595 8599 401a9a ??3@YAXPAX 8593->8599 8594->8562 8597 401ae7 8595->8597 8597->8599 8600 40c019 2 API calls 8597->8600 8598 401ab7 8601 40c125 VariantClear 8598->8601 8599->8598 8602 401b0c 8600->8602 8603 401ac5 ??3@YAXPAX 8601->8603 8604 401b10 GetLastError 8602->8604 8605 401b21 ??3@YAXPAX 8602->8605 8603->8547 8604->8599 8605->8590 8801 40bf1c 8607->8801 8611 40f896 8610->8611 8612 40f7c8 8610->8612 8613 40f7e5 8611->8613 8614 40f89b 8611->8614 8612->8613 8615 40f862 8612->8615 8616 40f7d7 8612->8616 8628 40f80b 8613->8628 8714 40f50e 8613->8714 8617 40f850 8614->8617 8620 40f8a5 8614->8620 8626 40f7f7 8614->8626 8615->8628 8688 412859 8615->8688 8616->8617 8618 40f7dc 8616->8618 8710 40c1b0 8617->8710 8627 40f7e2 8618->8627 8631 40f810 8618->8631 8620->8617 8620->8631 8625 40f878 8691 40c169 8625->8691 8626->8628 8702 40c1d5 8626->8702 8627->8613 8627->8626 8697 40c12a 8628->8697 8629 40c125 VariantClear 8634 401886 8629->8634 8631->8628 8706 40c1f5 8631->8706 8634->8547 8634->8548 8637 4013b3 8636->8637 8638 40119e 2 API calls 8637->8638 8639 4013be 8638->8639 8639->8556 8641 40136a 2 API calls 8640->8641 8642 40158b 8641->8642 8729 401455 8642->8729 8644 401596 8644->8560 8646 4033d0 8645->8646 8647 401a1f 8645->8647 8648 4033e1 8646->8648 8649 4033d4 SetLastError 8646->8649 8647->8584 8647->8585 8647->8586 8648->8647 8650 4033ea 8648->8650 8652 4033f8 FindFirstFileW 8648->8652 8649->8647 8732 403386 8650->8732 8652->8650 8653 40340b FindClose CompareFileTime 8652->8653 8653->8647 8653->8650 8655 40c0e1 8654->8655 8656 40c102 VariantClear 8655->8656 8657 40c119 8655->8657 8656->8551 8657->8551 8659 40279d 2 API calls 8658->8659 8660 40373e 8659->8660 8661 40119e 2 API calls 8660->8661 8663 40374e 8660->8663 8661->8663 8664 40379c GetSystemTimeAsFileTime GetFileAttributesW 8663->8664 8667 403840 8663->8667 8770 401ba1 CreateDirectoryW 8663->8770 8665 4037b1 8664->8665 8666 4037bb 8664->8666 8668 4033b3 22 API calls 8665->8668 8669 401ba1 4 API calls 8666->8669 8673 4037c1 ??3@YAXPAX 8666->8673 8670 403870 8667->8670 8667->8673 8668->8666 8680 4037ce 8669->8680 8672 408dd2 57 API calls 8670->8672 8671 4037d3 8776 408dd2 8671->8776 8677 40387a ??3@YAXPAX 8672->8677 8679 403885 8673->8679 8675 403834 ??3@YAXPAX 8675->8679 8676 4037e6 memcpy 8676->8680 8677->8679 8679->8570 8680->8671 8680->8675 8680->8676 8681 401ba1 4 API calls 8680->8681 8681->8680 8798 40c002 8682->8798 8686 40119e 2 API calls 8685->8686 8687 401384 8686->8687 8687->8593 8689 40136a 2 API calls 8688->8689 8690 412866 8689->8690 8690->8625 8718 40c153 8691->8718 8694 40c1a9 ??3@YAXPAX 8694->8628 8695 40c18e 8695->8694 8696 40c193 _CxxThrowException 8695->8696 8696->8694 8698 40c0e1 VariantClear 8697->8698 8699 40c136 8698->8699 8700 40c13a memcpy 8699->8700 8701 40c14f 8699->8701 8700->8701 8701->8629 8703 40c1e3 8702->8703 8704 40c1de 8702->8704 8703->8628 8705 40c153 VariantClear 8704->8705 8705->8703 8707 40c203 8706->8707 8708 40c1fe 8706->8708 8707->8628 8709 40c153 VariantClear 8708->8709 8709->8707 8711 40c1be 8710->8711 8712 40c1b9 8710->8712 8711->8628 8713 40c153 VariantClear 8712->8713 8713->8711 8715 40f520 8714->8715 8716 40f53c 8715->8716 8725 40c21c 8715->8725 8716->8628 8721 40c0e1 8718->8721 8720 40c15b SysAllocString 8720->8694 8720->8695 8724 40c0e9 8721->8724 8722 40c102 VariantClear 8722->8720 8723 40c119 8723->8720 8724->8722 8724->8723 8726 40c225 8725->8726 8727 40c22a 8725->8727 8728 40c153 VariantClear 8726->8728 8727->8716 8728->8727 8730 40140b 2 API calls 8729->8730 8731 401465 8730->8731 8731->8644 8738 40301f 8732->8738 8734 40338f 8735 4033b0 8734->8735 8736 403394 GetLastError 8734->8736 8735->8647 8737 40339f 8736->8737 8737->8647 8739 403028 8738->8739 8740 40302c GetFileAttributesW 8738->8740 8739->8734 8741 403042 8740->8741 8742 40303d 8740->8742 8743 403060 8741->8743 8744 403046 SetFileAttributesW 8741->8744 8742->8734 8749 402f12 8743->8749 8745 403053 DeleteFileW 8744->8745 8746 40305c 8744->8746 8745->8734 8746->8734 8750 40279d ??2@YAPAXI ??3@YAXPAX 8749->8750 8751 402f29 8750->8751 8752 4027ee ??2@YAPAXI ??3@YAXPAX 8751->8752 8753 402f36 FindFirstFileW 8752->8753 8754 402fee SetFileAttributesW 8753->8754 8767 402f58 8753->8767 8756 403011 ??3@YAXPAX 8754->8756 8757 402ff9 RemoveDirectoryW 8754->8757 8755 40139c ??2@YAPAXI ??3@YAXPAX 8755->8767 8759 403019 8756->8759 8757->8756 8758 403006 ??3@YAXPAX 8757->8758 8758->8759 8759->8734 8760 401552 ??2@YAPAXI ??3@YAXPAX 8760->8767 8761 4027ee ??2@YAPAXI ??3@YAXPAX 8761->8767 8762 402f88 lstrcmpW 8764 402fd1 FindNextFileW 8762->8764 8765 402f9e lstrcmpW 8762->8765 8763 402fbd SetFileAttributesW 8763->8756 8766 402fc6 DeleteFileW 8763->8766 8764->8767 8768 402fe7 FindClose 8764->8768 8765->8764 8765->8767 8766->8767 8767->8755 8767->8756 8767->8760 8767->8761 8767->8762 8767->8763 8767->8764 8769 402f12 ??2@YAPAXI ??3@YAXPAX 8767->8769 8768->8754 8769->8767 8771 401be2 8770->8771 8772 401bb2 GetLastError 8770->8772 8771->8663 8773 401bcc GetFileAttributesW 8772->8773 8775 401bc1 8772->8775 8773->8771 8773->8775 8774 401bc2 SetLastError 8774->8663 8775->8771 8775->8774 8777 4021b3 19 API calls 8776->8777 8778 408de6 wvsprintfW 8777->8778 8779 408eb5 8778->8779 8780 408e07 GetLastError FormatMessageW 8778->8780 8783 408cee 27 API calls 8779->8783 8781 408e35 FormatMessageW 8780->8781 8782 408e4a lstrlenW lstrlenW ??2@YAPAXI lstrcpyW lstrcpyW 8780->8782 8781->8779 8781->8782 8787 408cee 8782->8787 8785 408ec1 8783->8785 8785->8673 8788 408d63 ??3@YAXPAX LocalFree 8787->8788 8789 408cfd 8787->8789 8788->8785 8790 407cb6 4 API calls 8789->8790 8791 408d0c IsWindow 8790->8791 8792 408d35 8791->8792 8793 408d23 IsBadReadPtr 8791->8793 8794 407d17 22 API calls 8792->8794 8793->8792 8795 408d5b 8794->8795 8797 407a8a ??3@YAXPAX 8795->8797 8797->8788 8799 40bfe5 2 API calls 8798->8799 8800 401a72 8799->8800 8800->8590 8800->8591 8802 40be4b CloseHandle 8801->8802 8803 40bf27 8802->8803 8804 40bf50 8803->8804 8805 40bf2b CreateFileW 8803->8805 8804->8533 8805->8804 8808 409f10 8811 402788 8808->8811 8812 4026fb 47 API calls 8811->8812 8813 402791 8812->8813 8814 402796 8813->8814 8815 402797 malloc 8813->8815 8831 40e827 _EH_prolog 8843 40e85a 8831->8843 8832 40e987 8866 4011fd 8832->8866 8834 40e640 _CxxThrowException ??2@YAPAXI memcpy ??3@YAXPAX 8834->8843 8835 40e9b1 8838 40e9be ??2@YAPAXI 8835->8838 8836 40e99c 8917 40e585 8836->8917 8858 40e9d8 8838->8858 8839 40e7fd 15 API calls 8839->8843 8840 40c419 10 API calls ctype 8840->8843 8843->8832 8843->8834 8843->8839 8843->8840 8864 40e87c 8843->8864 8910 40e717 8843->8910 8914 40e563 8843->8914 8844 40ea22 8920 40e690 8844->8920 8845 40ea85 ??2@YAPAXI 8845->8858 8847 40e690 10 API calls 8847->8858 8851 40e585 ctype 10 API calls 8851->8858 8853 40eb02 8854 40e690 10 API calls 8853->8854 8855 40eb27 8854->8855 8856 40e585 ctype 10 API calls 8855->8856 8856->8864 8858->8844 8858->8845 8858->8847 8858->8851 8858->8853 8859 40ebc5 8858->8859 8858->8864 8876 40f112 8858->8876 8880 40e008 8858->8880 8923 40ed7f ??2@YAPAXI 8858->8923 8925 40f0bf 8858->8925 8861 40e690 10 API calls 8859->8861 8862 40ebe4 8861->8862 8863 40e585 ctype 10 API calls 8862->8863 8863->8864 8867 401261 SendMessageW 8866->8867 8868 40120b GetDiskFreeSpaceExW 8866->8868 8869 401249 8867->8869 8868->8867 8870 401223 8868->8870 8869->8835 8869->8836 8870->8867 8871 4021b3 19 API calls 8870->8871 8872 40123c 8871->8872 8873 408d65 27 API calls 8872->8873 8874 401242 8873->8874 8874->8869 8875 40125a 8874->8875 8875->8867 8877 40f13b 8876->8877 8929 40ef75 8877->8929 8933 40ffea 8880->8933 8883 40e025 8883->8858 8885 40e071 ??2@YAPAXI 8894 40e059 8885->8894 8886 40e139 8951 40dcfd 8886->8951 8888 40e095 ??2@YAPAXI 8888->8894 8894->8885 8894->8886 8894->8888 8987 40db28 ??2@YAPAXI 8894->8987 8911 40e726 8910->8911 8913 40e72c 8910->8913 8911->8843 8912 40e742 _CxxThrowException 8912->8911 8913->8911 8913->8912 8915 40c39f 4 API calls 8914->8915 8916 40e56b 8915->8916 8916->8843 8918 40c397 ctype 10 API calls 8917->8918 8919 40e593 8918->8919 8921 40db12 ctype 10 API calls 8920->8921 8922 40e69b 8921->8922 8924 40edb1 8923->8924 8924->8858 8926 40f0c4 8925->8926 8927 40f0eb 8926->8927 8928 40ee54 112 API calls 8926->8928 8927->8858 8928->8926 8932 40ef7a 8929->8932 8930 40efb0 8930->8858 8931 40ee54 112 API calls 8931->8932 8932->8930 8932->8931 8934 410003 8933->8934 8949 40e021 8933->8949 8934->8949 9017 40fdcb 8934->9017 8936 4101dd 8938 40c419 ctype 10 API calls 8936->8938 8937 40fdcb 14 API calls 8940 41009f 8937->8940 8938->8949 8940->8936 8941 4100cf 8940->8941 9024 40c419 8941->9024 8943 410155 8945 40c419 ctype 10 API calls 8943->8945 8944 4100d8 8944->8943 8946 40d7b5 _CxxThrowException ??2@YAPAXI memcpy ??3@YAXPAX 8944->8946 8947 410191 8945->8947 8946->8944 8948 40c419 ctype 10 API calls 8947->8948 8948->8949 8949->8883 8950 406edf InitializeCriticalSection 8949->8950 8950->8894 9103 40d794 8951->9103 8988 40db37 8987->8988 9140 40d7b5 8988->9140 9018 40c397 ctype 10 API calls 9017->9018 9019 40fdd7 9018->9019 9028 40c2ce 9019->9028 9021 40fdf3 9021->8936 9021->8937 9022 40fde1 9022->9021 9023 40e563 4 API calls 9022->9023 9023->9022 9025 40c3f8 9024->9025 9036 40c2ba 9025->9036 9029 40c362 9028->9029 9030 40c2e1 9028->9030 9029->9022 9031 40c2f0 _CxxThrowException 9030->9031 9032 40c320 ??2@YAPAXI 9030->9032 9033 40c352 ??3@YAXPAX 9030->9033 9031->9030 9032->9030 9034 40c336 memcpy 9032->9034 9033->9029 9034->9033 9040 401d26 VirtualFree 9036->9040 9042 40b7f0 9036->9042 9046 409f20 9036->9046 9049 40df18 9036->9049 9037 40c2cb ??3@YAXPAX 9037->8944 9040->9037 9043 40b816 9042->9043 9044 401d3f free 9043->9044 9045 40b83c 9044->9045 9045->9037 9047 401d3f free 9046->9047 9048 409f2a 9047->9048 9048->9037 9050 40df2d 9049->9050 9051 40df5b 9050->9051 9056 40dcb6 9050->9056 9069 40c3c7 9051->9069 9073 40d765 9056->9073 9059 40c419 ctype 10 API calls 9060 40dccf 9059->9060 9061 40c419 ctype 10 API calls 9060->9061 9062 40dcda 9061->9062 9063 40db12 ctype 10 API calls 9062->9063 9064 40dce5 9063->9064 9065 40db12 ctype 10 API calls 9064->9065 9066 40dced 9065->9066 9081 40dc88 9066->9081 9070 40c3db 9069->9070 9071 40c3ef 9070->9071 9102 40c368 memmove 9070->9102 9071->9037 9074 40d774 9073->9074 9075 40d77a 9073->9075 9090 406e83 SetEvent 9074->9090 9077 40d790 9075->9077 9093 406e27 WaitForSingleObject 9075->9093 9077->9059 9079 40d78a 9094 406dfd 9079->9094 9082 40d765 5 API calls 9081->9082 9083 40dc96 9082->9083 9084 406dfd 2 API calls 9083->9084 9085 40dc9f 9084->9085 9086 406dfd 2 API calls 9085->9086 9087 40dca8 9086->9087 9088 406dfd 2 API calls 9087->9088 9089 40dcb1 9088->9089 9098 406de7 9090->9098 9092 406e95 9092->9075 9093->9079 9095 406e1d 9094->9095 9096 406e08 CloseHandle 9094->9096 9095->9077 9096->9095 9097 406e13 GetLastError 9096->9097 9097->9095 9099 406df1 GetLastError 9098->9099 9100 406dee 9098->9100 9101 406dfb 9099->9101 9100->9092 9101->9092 9102->9071 9104 40c397 ctype 10 API calls 9103->9104 9105 40d79c 9104->9105 9106 40c397 ctype 10 API calls 9105->9106 9107 40d7a4 9106->9107 9108 40c397 ctype 10 API calls 9107->9108 9109 40d7ac 9108->9109 9143 40c39f 9140->9143 9144 40c3c6 9143->9144 9145 40c3a7 9143->9145 9144->8894 9146 40c2ce 4 API calls 9145->9146 9146->9144 8806 40be30 ??2@YAPAXI 8807 40be41 8806->8807 9261 412dcf __set_app_type __p__fmode __p__commode 9262 412e3e 9261->9262 9263 412e52 9262->9263 9264 412e46 __setusermatherr 9262->9264 9273 412f46 _controlfp 9263->9273 9264->9263 9266 412e57 _initterm __getmainargs _initterm 9267 412eab GetStartupInfoA 9266->9267 9269 412edf GetModuleHandleA 9267->9269 9274 406da1 _EH_prolog 9269->9274 9273->9266 9277 405750 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z 9274->9277 9634 401d4d GetModuleHandleW CreateWindowExW 9277->9634 9280 406d80 MessageBoxA 9282 406d97 exit _XcptFilter 9280->9282 9281 40578e 9281->9280 9283 4057a8 9281->9283 9284 401484 2 API calls 9283->9284 9285 4057df 9284->9285 9286 401484 2 API calls 9285->9286 9287 4057ea 9286->9287 9637 4044f2 9287->9637 9292 4027ee 2 API calls 9293 405828 9292->9293 9646 402e02 9293->9646 9295 405831 9660 404424 9295->9660 9299 405850 _wtol 9301 405866 9299->9301 9665 404932 #17 9301->9665 9302 404424 3 API calls 9303 405896 9302->9303 9304 4058d0 9303->9304 9305 40589c 9303->9305 9307 404424 3 API calls 9304->9307 9826 404ec8 9305->9826 9308 4058db 9307->9308 9309 4058e1 9308->9309 9310 4058ec 9308->9310 9848 4052d6 9309->9848 9313 404424 3 API calls 9310->9313 9311 4058a3 ??3@YAXPAX 9843 40453f 9311->9843 9319 4058fb 9313->9319 9315 4058b4 ??3@YAXPAX ??3@YAXPAX 9315->9282 9316 405930 GetModuleFileNameW 9317 405942 9316->9317 9318 405954 9316->9318 9321 408dd2 57 API calls 9317->9321 9322 404424 3 API calls 9318->9322 9319->9316 9320 40119e 2 API calls 9319->9320 9320->9316 9359 4058a1 9321->9359 9333 405976 9322->9333 9323 405b12 9324 4013d5 2 API calls 9323->9324 9325 405b22 9324->9325 9326 4013d5 2 API calls 9325->9326 9330 405b2f 9326->9330 9327 405a67 9329 404424 3 API calls 9327->9329 9328 405a34 9328->9327 9332 405a50 _wtol 9328->9332 9328->9359 9341 405ac6 9329->9341 9331 405bb4 9330->9331 9335 40139c 2 API calls 9330->9335 9691 4023cc 9331->9691 9332->9327 9333->9323 9333->9327 9333->9328 9333->9359 9856 401552 9333->9856 9337 405b64 9335->9337 9340 40139c 2 API calls 9337->9340 9339 40139c 2 API calls 9342 405bda ??2@YAPAXI 9339->9342 9346 405b7a 9340->9346 9341->9323 9343 404ac6 2 API calls 9341->9343 9344 405be6 9342->9344 9345 405af7 9343->9345 9694 40bf94 9344->9694 9345->9323 9347 4013d5 2 API calls 9345->9347 9348 4013d5 2 API calls 9346->9348 9347->9323 9349 405ba4 9348->9349 9351 4021b3 19 API calls 9349->9351 9353 405bab 9351->9353 9356 4027ee 2 API calls 9353->9356 9354 405c13 9357 408dd2 57 API calls 9354->9357 9355 405c39 9697 40284f 9355->9697 9356->9331 9357->9359 9359->9311 9362 405c4e 9363 405c54 9362->9363 9364 405c78 9362->9364 9365 408dd2 57 API calls 9363->9365 9366 405d0a 9364->9366 9368 404424 3 API calls 9364->9368 9367 405c5c ??3@YAXPAX 9365->9367 9369 40c397 ctype 10 API calls 9366->9369 9367->9359 9371 405c8f 9368->9371 9370 405d12 9369->9370 9372 405d37 9370->9372 9885 40342c 9370->9885 9371->9366 9379 405c95 9371->9379 9374 405cee ??3@YAXPAX 9372->9374 9393 405d40 9372->9393 9374->9359 9376 405d2c ??3@YAXPAX 9376->9359 9377 405db1 9731 404b35 9377->9731 9378 405d4c wsprintfW 9381 401484 2 API calls 9378->9381 9379->9374 9859 4054f0 9379->9859 9381->9393 9383 405cc4 9383->9374 9385 405cca 9383->9385 9384 401484 2 API calls 9384->9393 9386 408dd2 57 API calls 9385->9386 9388 405cd2 ??3@YAXPAX 9386->9388 9387 40139c ??2@YAPAXI ??3@YAXPAX 9387->9393 9388->9359 9389 4021b3 19 API calls 9389->9393 9390 406035 9392 404b35 26 API calls 9390->9392 9391 404247 lstrlenW lstrlenW _wcsnicmp 9437 405dba 9391->9437 9394 406044 9392->9394 9393->9377 9393->9378 9393->9384 9393->9387 9393->9389 9914 403305 ??2@YAPAXI 9393->9914 9920 4026c6 ??3@YAXPAX ??3@YAXPAX 9393->9920 9395 4061cc 9394->9395 9946 40247a AllocateAndInitializeSid 9394->9946 9790 4026dc 9395->9790 9401 40627d 9793 404620 9401->9793 9403 406069 9406 401484 2 API calls 9403->9406 9404 40279d 2 API calls 9447 4061e4 9404->9447 9408 406071 9406->9408 9411 401484 2 API calls 9408->9411 9409 406310 CoInitialize 9418 4026dc lstrcmpW 9409->9418 9410 4062a4 9413 4026dc lstrcmpW 9410->9413 9414 406079 GetCommandLineW 9411->9414 9417 4062b3 9413->9417 9419 404ac6 2 API calls 9414->9419 9415 40627f ??3@YAXPAX 9415->9401 9416 401484 ??2@YAPAXI ??3@YAXPAX 9416->9447 9420 4062c3 9417->9420 9423 4021b3 19 API calls 9417->9423 9421 406336 9418->9421 9422 406089 9419->9422 9983 4041d7 9420->9983 9424 40634a 9421->9424 9427 40139c 2 API calls 9421->9427 9425 40279d 2 API calls 9422->9425 9423->9420 9429 4041f0 16 API calls 9424->9429 9428 406094 9425->9428 9427->9424 9949 4048d8 9428->9949 9433 406350 9429->9433 9431 4013d5 2 API calls 9431->9447 9435 4026dc lstrcmpW 9433->9435 9434 407d17 22 API calls 9436 4062e6 9434->9436 9439 40635f 9435->9439 9986 407a8a ??3@YAXPAX 9436->9986 9437->9390 9437->9391 9462 405f99 _wtol 9437->9462 9491 406179 ??3@YAXPAX 9437->9491 9921 404d7f 9437->9921 9932 404677 9437->9932 9444 406373 9439->9444 9445 406366 _wtol 9439->9445 9441 40139c 2 API calls 9441->9447 9449 406399 9444->9449 9987 408f94 9444->9987 9445->9444 9446 4062f1 ??3@YAXPAX 9446->9359 9447->9401 9447->9404 9447->9415 9447->9416 9447->9431 9447->9441 9450 403305 7 API calls 9447->9450 9982 4026c6 ??3@YAXPAX ??3@YAXPAX 9447->9982 9448 4048f6 2 API calls 9451 4060cc 9448->9451 9454 406384 ??3@YAXPAX 9449->9454 9477 4063ad 9449->9477 10003 408ec7 9449->10003 9450->9447 9959 404914 9451->9959 9454->9449 9458 40625a ??3@YAXPAX 9460 4026dc lstrcmpW 9458->9460 9459 40157d 2 API calls 9461 4060e6 9459->9461 9460->9447 9463 4013d5 2 API calls 9461->9463 9462->9437 9466 4060f2 7 API calls 9463->9466 9464 401484 2 API calls 9464->9477 9964 404f96 9466->9964 9468 406532 ??3@YAXPAX 9468->9359 9469 4063eb GetKeyState 9469->9477 9470 40613b 9472 406145 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9470->9472 9473 406196 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9470->9473 9471 4026dc lstrcmpW 9471->9477 9476 40616c 9472->9476 9473->9311 9475 4061c1 9473->9475 9474 406592 9478 4065c8 9474->9478 9479 40659a 9474->9479 9475->9311 9476->9359 9477->9464 9477->9468 9477->9469 9477->9471 9477->9474 9483 401552 ??2@YAPAXI ??3@YAXPAX 9477->9483 9492 406582 ??3@YAXPAX ??3@YAXPAX 9477->9492 9493 406527 ??3@YAXPAX 9477->9493 9494 40654f 9477->9494 9495 40139c ??2@YAPAXI ??3@YAXPAX 9477->9495 10030 408474 9477->10030 10043 4084f2 9477->10043 9481 40136a 2 API calls 9478->9481 10051 404571 9479->10051 9485 4065d6 9481->9485 9483->9477 9488 4041f0 16 API calls 9485->9488 9487 4013d5 2 API calls 9489 4065b7 ??3@YAXPAX 9487->9489 9490 4065df 9488->9490 9500 4065ff 9489->9500 9496 4065f0 ??3@YAXPAX 9490->9496 9498 4013d5 2 API calls 9490->9498 9491->9359 9492->9359 9493->9477 9497 408dd2 57 API calls 9494->9497 9495->9477 9496->9500 9499 40655b ??3@YAXPAX ??3@YAXPAX 9497->9499 9498->9496 9499->9359 9501 406649 9500->9501 9502 40663c 9500->9502 10064 408532 9501->10064 9799 401758 ??2@YAPAXI 9502->9799 9505 406645 9506 406686 9505->9506 9507 40665b 9505->9507 9508 404620 22 API calls 9506->9508 10072 4044dc 9507->10072 9509 40668b 9508->9509 9512 406c7c 9509->9512 9513 401484 2 API calls 9509->9513 9515 406cf4 9512->9515 9516 4026dc lstrcmpW 9512->9516 9514 4066a9 9513->9514 9559 4066bc 9514->9559 10076 404a70 9514->10076 9518 406d37 ??3@YAXPAX ??3@YAXPAX 9515->9518 9523 4026dc lstrcmpW 9515->9523 9521 406cad 9516->9521 9519 406d50 9518->9519 9520 406d56 ??3@YAXPAX 9518->9520 9519->9520 9522 40453f 11 API calls 9520->9522 9521->9515 10140 4044c3 9521->10140 9524 406d67 ??3@YAXPAX ??3@YAXPAX 9522->9524 9525 406d13 9523->9525 9524->9282 9525->9518 9530 406d20 9525->9530 9526 401484 ??2@YAPAXI ??3@YAXPAX 9526->9559 9528 4066eb 9531 406b12 ??3@YAXPAX ??3@YAXPAX 9528->9531 9532 4066f8 9528->9532 9535 40136a 2 API calls 9530->9535 9539 406c1b 9531->9539 9537 4048f6 2 API calls 9532->9537 9533 4026dc lstrcmpW 9533->9559 9534 407d17 22 API calls 9538 406ce9 9534->9538 9536 406d2f 9535->9536 10144 405333 9536->10144 9542 406714 9537->9542 10143 407a8a ??3@YAXPAX 9538->10143 9540 406c73 ??3@YAXPAX 9539->9540 9545 404620 22 API calls 9539->9545 9540->9512 9547 4048f6 2 API calls 9542->9547 9543 406758 9548 40139c 2 API calls 9543->9548 9549 406c2a 9545->9549 9550 406721 9547->9550 9551 406761 9548->9551 9816 404ddd 9549->9816 9553 4013d5 2 API calls 9550->9553 9555 404224 20 API calls 9551->9555 9558 40672d ??3@YAXPAX ??3@YAXPAX GetFileAttributesW 9553->9558 9554 406b78 ??3@YAXPAX ??3@YAXPAX 9554->9539 9571 40676a 9555->9571 9556 40139c 2 API calls 9556->9559 9557 406c43 SetCurrentDirectoryW 9560 404ddd 4 API calls 9557->9560 9561 406754 9558->9561 9562 406b29 9558->9562 9559->9526 9559->9528 9559->9533 9559->9543 9559->9554 9559->9556 9563 401552 2 API calls 9559->9563 9564 406c6b 9560->9564 9561->9543 9565 4044dc 16 API calls 9562->9565 9566 4067f8 ??3@YAXPAX ??3@YAXPAX 9563->9566 9567 4044dc 16 API calls 9564->9567 9568 406b2e 9565->9568 9566->9559 9567->9540 9569 408dd2 57 API calls 9568->9569 9570 406b37 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9569->9570 9570->9359 9570->9476 9572 406897 _wtol 9571->9572 9573 404281 lstrlenW lstrlenW _wcsnicmp 9571->9573 9574 40695b 9571->9574 9572->9571 9573->9571 9575 406964 9574->9575 9576 4069b6 9574->9576 9577 406989 9575->9577 9578 40696a 9575->9578 9579 4013d5 2 API calls 9576->9579 9580 40139c 2 API calls 9577->9580 9581 40139c 2 API calls 9578->9581 9582 4069b4 9579->9582 9584 406987 9580->9584 9583 406975 9581->9583 9585 4027ee 2 API calls 9582->9585 9586 4027ee 2 API calls 9583->9586 9588 4026dc lstrcmpW 9584->9588 9587 4069c8 9585->9587 9590 40697e 9586->9590 9589 401484 2 API calls 9587->9589 9591 40699e 9588->9591 9592 4069d0 9589->9592 9593 4027ee 2 API calls 9590->9593 9591->9587 9595 4027ee 2 API calls 9591->9595 9594 404ac6 2 API calls 9592->9594 9593->9584 9596 4069dd 9594->9596 9595->9582 9597 40279d 2 API calls 9596->9597 9598 4069e8 9597->9598 9599 404224 20 API calls 9598->9599 9600 4069f1 9599->9600 9601 406acc 9600->9601 10085 402449 9600->10085 9602 406bfa ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9601->9602 9604 406ae0 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9601->9604 9602->9539 9604->9531 9605 406a06 9605->9601 9606 406a2c 9605->9606 9608 4027ee 2 API calls 9605->9608 9607 404224 20 API calls 9606->9607 9610 406a38 9607->9610 9609 406a20 9608->9609 9609->9606 9611 406aae 9610->9611 9612 406a3f 9610->9612 10092 40506d 9611->10092 9614 4048d8 2 API calls 9612->9614 9616 406a57 9614->9616 9615 406abc 9617 406b97 SetLastError 9615->9617 9618 406ac7 9615->9618 9619 4048f6 2 API calls 9616->9619 9621 406b9e 9617->9621 10137 4023e1 9618->10137 9622 406a67 9619->9622 9623 408dd2 57 API calls 9621->9623 9624 40157d 2 API calls 9622->9624 9625 406ba8 9623->9625 9626 406a74 ??3@YAXPAX ??3@YAXPAX 9624->9626 9627 4044dc 16 API calls 9625->9627 9628 404f96 9 API calls 9626->9628 9629 406bad 7 API calls 9627->9629 9630 406a98 9628->9630 9631 406bed 9629->9631 9632 406aa6 ??3@YAXPAX 9630->9632 9633 406b8f ??3@YAXPAX 9630->9633 9631->9602 9632->9618 9633->9621 9635 401d82 SetTimer GetMessageW DispatchMessageW KillTimer KiUserCallbackDispatcher 9634->9635 9636 401db5 GetVersionExW 9634->9636 9635->9636 9636->9280 9636->9281 9638 40119e 2 API calls 9637->9638 9639 404507 GetCommandLineW 9638->9639 9640 404ac6 9639->9640 9641 404b00 9640->9641 9642 404ad4 9640->9642 9643 404af8 9641->9643 9645 401552 2 API calls 9641->9645 9642->9643 9644 401552 2 API calls 9642->9644 9643->9292 9644->9642 9645->9641 9647 401484 2 API calls 9646->9647 9655 402e12 9647->9655 9648 402ef8 9649 4013d5 2 API calls 9648->9649 9650 402f05 ??3@YAXPAX 9649->9650 9650->9295 9651 401552 ??2@YAPAXI ??3@YAXPAX 9651->9655 9653 401484 2 API calls 9653->9655 9655->9648 9655->9651 9655->9653 9656 4013d5 2 API calls 9655->9656 10183 402867 9655->10183 10186 402b04 9655->10186 9657 402e72 ??3@YAXPAX 9656->9657 9658 401455 2 API calls 9657->9658 9659 402e87 ??3@YAXPAX ??3@YAXPAX 9658->9659 9659->9655 9661 404433 9660->9661 9662 404470 9661->9662 9663 40444d lstrlenW lstrlenW 9661->9663 9662->9299 9662->9301 10197 401ca0 9663->10197 9666 404949 9665->9666 9667 40215d 3 API calls 9666->9667 9668 40494e 9667->9668 9669 4021b3 19 API calls 9668->9669 9670 404955 9669->9670 9671 4021b3 19 API calls 9670->9671 9672 404961 9671->9672 9673 4021b3 19 API calls 9672->9673 9674 40496d 9673->9674 9675 4021b3 19 API calls 9674->9675 9676 404979 9675->9676 9677 4021b3 19 API calls 9676->9677 9678 404985 9677->9678 9679 4021b3 19 API calls 9678->9679 9680 404991 9679->9680 9681 4021b3 19 API calls 9680->9681 9687 40499d 9681->9687 9682 4049b8 SHGetSpecialFolderPathW 9683 4049d2 wsprintfW 9682->9683 9682->9687 9684 401484 2 API calls 9683->9684 9684->9687 9685 404a6b 9685->9302 9686 401484 2 API calls 9686->9687 9687->9682 9687->9685 9687->9686 9688 40139c ??2@YAPAXI ??3@YAXPAX 9687->9688 9690 403305 7 API calls 9687->9690 10207 4026c6 ??3@YAXPAX ??3@YAXPAX 9687->10207 9688->9687 9690->9687 10208 40239b LoadLibraryA GetProcAddress 9691->10208 9693 4023d1 9693->9339 10211 40bf72 9694->10211 9698 40253b 2 API calls 9697->9698 9699 402863 9698->9699 9700 403cbf 9699->9700 9701 40239b 3 API calls 9700->9701 9702 403ccd 9701->9702 9703 40284f 2 API calls 9702->9703 9704 403d06 9703->9704 9705 40284f 2 API calls 9704->9705 9706 403d0e 9705->9706 9707 40284f 2 API calls 9706->9707 9708 403d16 9707->9708 10217 403bce 9708->10217 9714 403dac 9715 403bce 7 API calls 9714->9715 9717 403dc2 9715->9717 9716 403bce 7 API calls 9721 403d53 9716->9721 9719 402c1a 10 API calls 9717->9719 9718 402c1a 10 API calls 9718->9721 9720 403dd4 9719->9720 10260 4029b5 9720->10260 9721->9714 9721->9716 9721->9718 9724 4029b5 2 API calls 9721->9724 10263 40297f 9721->10263 9724->9721 9725 403e4a ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9725->9362 9726 403bce 7 API calls 9728 403dea 9726->9728 9727 402c1a 10 API calls 9727->9728 9728->9725 9728->9726 9728->9727 9729 40297f 2 API calls 9728->9729 9730 4029b5 2 API calls 9728->9730 9729->9728 9730->9728 9732 4026dc lstrcmpW 9731->9732 9733 404b4e 9732->9733 9734 404b9e 9733->9734 9736 40139c 2 API calls 9733->9736 9735 4026dc lstrcmpW 9734->9735 9738 404bbc 9735->9738 9737 404b65 9736->9737 9739 4021b3 19 API calls 9737->9739 9740 4026dc lstrcmpW 9738->9740 9741 404b6c 9739->9741 9742 404bd4 9740->9742 9743 4027ee 2 API calls 9741->9743 9745 4026dc lstrcmpW 9742->9745 9744 404b75 9743->9744 9746 40139c 2 API calls 9744->9746 9747 404bec 9745->9747 9748 404b8e 9746->9748 9750 4026dc lstrcmpW 9747->9750 9749 4021b3 19 API calls 9748->9749 9751 404b95 9749->9751 9752 404c04 9750->9752 9753 4027ee 2 API calls 9751->9753 9754 404c1b 9752->9754 9755 404c0b lstrcmpiW 9752->9755 9753->9734 9756 4026dc lstrcmpW 9754->9756 9755->9754 9757 404c31 9756->9757 9758 4026dc lstrcmpW 9757->9758 9759 404c5e 9758->9759 9760 404c6b 9759->9760 10293 4043d2 9759->10293 9762 4026dc lstrcmpW 9760->9762 9766 404c7f 9762->9766 9763 404c9f 9764 4026dc lstrcmpW 9763->9764 9774 404cb2 9764->9774 9766->9763 9767 4026dc lstrcmpW 9766->9767 10297 404379 9766->10297 9767->9766 9768 404cd2 9770 4026dc lstrcmpW 9768->9770 9771 404cde 9770->9771 9773 4026dc lstrcmpW 9771->9773 9772 4026dc lstrcmpW 9772->9774 9775 404cef 9773->9775 9774->9768 9774->9772 10301 4043aa 9774->10301 9776 4026dc lstrcmpW 9775->9776 9777 404d00 9776->9777 9778 404d16 9777->9778 9779 404d0d _wtol 9777->9779 9780 4026dc lstrcmpW 9778->9780 9779->9778 9781 404d22 9780->9781 9782 404d32 9781->9782 9783 404d29 _wtol 9781->9783 9784 4026dc lstrcmpW 9782->9784 9783->9782 9785 404d3e 9784->9785 9786 4026dc lstrcmpW 9785->9786 9787 404d56 9786->9787 9788 4026dc lstrcmpW 9787->9788 9789 404d6e 9788->9789 9789->9437 10309 402646 9790->10309 9794 404631 9793->9794 9795 404674 9793->9795 9796 40136a 2 API calls 9794->9796 9797 404224 20 API calls 9794->9797 9795->9409 9795->9410 9796->9794 9798 40464e SetEnvironmentVariableW ??3@YAXPAX 9797->9798 9798->9794 9798->9795 9800 401771 9799->9800 9815 40c5fe 3 API calls 9800->9815 9801 401795 9802 4017c0 9801->9802 10313 40110a 9801->10313 9804 408dd2 57 API calls 9802->9804 9814 4017c8 9804->9814 9806 4017e8 9807 401800 ??2@YAPAXI 9806->9807 9808 40371d 88 API calls 9806->9808 9809 401813 9807->9809 9810 40180c 9807->9810 9811 4017fb 9808->9811 10317 40163d 9809->10317 10336 40149c 9810->10336 9811->9807 9811->9814 9814->9505 9815->9801 9817 401484 2 API calls 9816->9817 9822 404dee 9817->9822 9818 40139c 2 API calls 9818->9822 9819 404e80 9821 404eba ??3@YAXPAX 9819->9821 9824 404ddd 3 API calls 9819->9824 9820 401552 2 API calls 9820->9822 9821->9557 9822->9818 9822->9819 9822->9820 9823 4026dc lstrcmpW 9822->9823 9823->9822 9825 404eb7 9824->9825 9825->9821 9827 407cb6 4 API calls 9826->9827 9828 404ee4 9827->9828 9829 4021b3 19 API calls 9828->9829 9830 404ef2 9829->9830 9831 40279d 2 API calls 9830->9831 9836 404efc 9831->9836 9832 404f32 wsprintfW 9833 4027ee 2 API calls 9832->9833 9835 404f60 9833->9835 9834 4027ee ??2@YAPAXI ??3@YAXPAX 9834->9836 9837 4027ee 2 API calls 9835->9837 9836->9832 9836->9834 9838 404f6d 9837->9838 9839 407d17 22 API calls 9838->9839 9840 404f82 ??3@YAXPAX 9839->9840 10754 407a8a ??3@YAXPAX 9840->10754 9842 404f93 9842->9359 9844 40c397 ctype 10 API calls 9843->9844 9845 40454d 9844->9845 9846 40c2ba ctype 10 API calls 9845->9846 9847 40c402 ??3@YAXPAX 9846->9847 9847->9315 9849 4052e3 9848->9849 9855 4052ff 9848->9855 9851 4052f5 _wtol 9849->9851 9849->9855 9850 404f96 9 API calls 9852 405322 9850->9852 9851->9855 9853 405330 9852->9853 9854 40532a GetLastError 9852->9854 9853->9359 9854->9853 9855->9850 9857 40140b 2 API calls 9856->9857 9858 40155c 9857->9858 9858->9333 9860 40c019 2 API calls 9859->9860 9861 40551c 9860->9861 9862 405578 9861->9862 9863 40279d 2 API calls 9861->9863 9864 40284f 2 API calls 9862->9864 9870 40552b 9863->9870 9865 405580 9864->9865 9866 4028e5 2 API calls 9865->9866 9867 40558d 9866->9867 9868 40297f 2 API calls 9867->9868 9871 40559a 9868->9871 9869 4055e9 ??3@YAXPAX 9884 4055e5 9869->9884 9870->9869 9872 40371d 88 API calls 9870->9872 9873 40297f 2 API calls 9871->9873 9874 40554f 9872->9874 9875 4055a7 9873->9875 9874->9869 9877 40c019 2 API calls 9874->9877 9876 40297f 2 API calls 9875->9876 9878 4055b4 9876->9878 9879 40556b 9877->9879 9880 40c662 2 API calls 9878->9880 9879->9869 9881 40556f ??3@YAXPAX 9879->9881 9882 4055c8 9880->9882 9881->9862 9882->9869 9883 4055d1 ??3@YAXPAX 9882->9883 9883->9884 9884->9383 9886 40284f 2 API calls 9885->9886 9892 403441 9886->9892 9887 4036e0 ??3@YAXPAX 9889 403717 9887->9889 9888 401484 ??2@YAPAXI ??3@YAXPAX 9888->9892 9889->9372 9889->9376 9890 40284f 2 API calls 9890->9892 9891 402b04 ??2@YAPAXI ??3@YAXPAX MultiByteToWideChar 9891->9892 9892->9887 9892->9888 9892->9890 9892->9891 9893 4013d5 2 API calls 9892->9893 9895 4036ec 9892->9895 9900 4035bf strncmp 9892->9900 9904 4013d5 2 API calls 9892->9904 9905 402957 2 API calls 9892->9905 9909 402957 ??2@YAPAXI ??3@YAXPAX 9892->9909 9910 403674 lstrlenW wcsncmp 9892->9910 9911 402646 lstrcmpW 9892->9911 9912 403305 7 API calls 9892->9912 9913 40139c 2 API calls 9892->9913 10755 40268e 9892->10755 10759 4026c6 ??3@YAXPAX ??3@YAXPAX 9892->10759 9894 4034b2 ??3@YAXPAX ??3@YAXPAX 9893->9894 9894->9892 9894->9895 10760 402d5c 9895->10760 9899 40370d ??3@YAXPAX 9899->9889 9900->9892 9902 4035aa strncmp 9900->9902 9902->9892 9902->9900 9906 40362c ??3@YAXPAX 9904->9906 9905->9902 9907 402e02 9 API calls 9906->9907 9908 40363d lstrcmpW 9907->9908 9908->9892 9909->9892 9910->9892 9911->9892 9912->9892 9913->9892 9915 40331f 9914->9915 9916 403314 9914->9916 9918 40d7b5 4 API calls 9915->9918 10779 4029e3 9916->10779 9919 40332b 9918->9919 9919->9393 9920->9393 9922 40279d 2 API calls 9921->9922 9923 404d91 9922->9923 9924 4027ee 2 API calls 9923->9924 9929 404d9e 9924->9929 9925 404dba 9926 4027ee 2 API calls 9925->9926 9928 404dc4 9926->9928 9927 401552 2 API calls 9927->9929 9930 404677 94 API calls 9928->9930 9929->9925 9929->9927 9931 404dcf ??3@YAXPAX 9930->9931 9931->9437 9933 4046ba 9932->9933 9934 40468e lstrlenW 9932->9934 9933->9437 9935 401ca0 CharUpperW 9934->9935 9936 4046a4 9935->9936 9936->9933 9936->9934 9937 4046c1 9936->9937 9938 40279d 2 API calls 9937->9938 9939 4046ca 9938->9939 10784 402b4c 9939->10784 9942 40342c 87 API calls 9943 404738 9942->9943 9944 404742 ??3@YAXPAX ??3@YAXPAX 9943->9944 9945 404759 ??3@YAXPAX ??3@YAXPAX 9943->9945 9944->9933 9945->9933 9947 4024d7 9946->9947 9948 4024bd CheckTokenMembership FreeSid 9946->9948 9947->9395 9947->9403 9948->9947 9950 4044f2 2 API calls 9949->9950 9951 4048e6 9950->9951 9952 401455 2 API calls 9951->9952 9953 4048f1 9952->9953 9954 4048f6 9953->9954 9955 40136a 2 API calls 9954->9955 9956 404904 9955->9956 9957 4027ee 2 API calls 9956->9957 9958 40490f 9957->9958 9958->9448 9960 40136a 2 API calls 9959->9960 9961 404922 9960->9961 9962 401552 2 API calls 9961->9962 9963 40492d 9962->9963 9963->9459 9965 401484 2 API calls 9964->9965 9966 404fa7 9965->9966 9967 401484 2 API calls 9966->9967 9968 404faf memset 9967->9968 9969 404fdd 9968->9969 9970 404ac6 2 API calls 9969->9970 9971 405000 9970->9971 9972 40139c 2 API calls 9971->9972 9973 40500b 9972->9973 9974 405010 ??3@YAXPAX 9973->9974 9975 405029 ShellExecuteExW 9973->9975 9976 40501b ??3@YAXPAX 9974->9976 9977 405043 9975->9977 9978 405069 9975->9978 9976->9470 9979 405057 CloseHandle 9977->9979 9980 40504c WaitForSingleObject 9977->9980 9981 405060 ??3@YAXPAX 9978->9981 9979->9981 9980->9979 9981->9976 9982->9458 9984 407cb6 4 API calls 9983->9984 9985 4041df 9984->9985 9985->9434 9986->9446 9988 409218 9987->9988 10000 408fb3 9987->10000 9988->9454 9989 407cb6 4 API calls 9989->10000 9990 408532 25 API calls 9990->10000 9991 4026dc lstrcmpW 9991->10000 9992 408474 25 API calls 9992->10000 9994 4084f2 25 API calls 9994->10000 9995 4041d7 4 API calls 9995->10000 9996 4021b3 19 API calls 9996->10000 9998 408dd2 57 API calls 9998->10000 9999 4044c3 4 API calls 9999->10000 10000->9988 10000->9989 10000->9990 10000->9991 10000->9992 10000->9994 10000->9995 10000->9996 10000->9998 10000->9999 10001 408d65 27 API calls 10000->10001 10002 407d17 22 API calls 10000->10002 10794 407d91 10000->10794 10798 407a8a ??3@YAXPAX 10000->10798 10001->10000 10002->10000 10004 4026dc lstrcmpW 10003->10004 10005 408edb 10004->10005 10006 408ee9 10005->10006 10799 401c0b GetStdHandle WriteFile 10005->10799 10008 408efc 10006->10008 10800 401c0b GetStdHandle WriteFile 10006->10800 10010 408f11 10008->10010 10801 401c0b GetStdHandle WriteFile 10008->10801 10012 408f22 10010->10012 10802 401c0b GetStdHandle WriteFile 10010->10802 10014 4026dc lstrcmpW 10012->10014 10015 408f2f 10014->10015 10016 408f3d 10015->10016 10803 401c0b GetStdHandle WriteFile 10015->10803 10018 4026dc lstrcmpW 10016->10018 10019 408f4a 10018->10019 10020 408f58 10019->10020 10804 401c0b GetStdHandle WriteFile 10019->10804 10022 4026dc lstrcmpW 10020->10022 10023 408f65 10022->10023 10024 408f73 10023->10024 10805 401c0b GetStdHandle WriteFile 10023->10805 10025 4026dc lstrcmpW 10024->10025 10028 408f80 10025->10028 10027 408f90 10027->9449 10028->10027 10806 401c0b GetStdHandle WriteFile 10028->10806 10031 408497 10030->10031 10032 4084ca 10031->10032 10033 4084ac 10031->10033 10810 407e9b 10032->10810 10807 407e69 10033->10807 10038 407d17 22 API calls 10040 4084c5 10038->10040 10039 407d17 22 API calls 10039->10040 10813 407a8a ??3@YAXPAX 10040->10813 10042 4084ed 10042->9477 10044 408507 10043->10044 10045 407e82 4 API calls 10044->10045 10046 408512 10045->10046 10047 407d17 22 API calls 10046->10047 10048 408523 10047->10048 10817 407a8a ??3@YAXPAX 10048->10817 10050 40852d 10050->9477 10052 401484 2 API calls 10051->10052 10053 404582 10052->10053 10054 4027d6 2 API calls 10053->10054 10055 40458b GetTempPathW 10054->10055 10056 4045a4 10055->10056 10061 4045bb 10055->10061 10057 4027d6 2 API calls 10056->10057 10058 4045af GetTempPathW 10057->10058 10058->10061 10059 4027d6 2 API calls 10060 4045de wsprintfW 10059->10060 10060->10061 10061->10059 10062 4045f5 GetFileAttributesW 10061->10062 10063 404619 10061->10063 10062->10061 10062->10063 10063->9487 10065 408545 10064->10065 10818 407eb4 10065->10818 10068 407d17 22 API calls 10069 40857a 10068->10069 10821 407a8a ??3@YAXPAX 10069->10821 10071 408584 10071->9505 10073 4044f0 ??3@YAXPAX ??3@YAXPAX 10072->10073 10074 4044e5 10072->10074 10073->9359 10075 40301f 16 API calls 10074->10075 10075->10073 10077 4026dc lstrcmpW 10076->10077 10079 404a8f 10077->10079 10078 404ac4 10078->9559 10079->10078 10080 40139c 2 API calls 10079->10080 10081 404a9e 10080->10081 10082 404224 20 API calls 10081->10082 10083 404aa4 10082->10083 10083->10078 10084 401552 2 API calls 10083->10084 10084->10078 10086 402457 10085->10086 10091 402452 10085->10091 10087 40239b 3 API calls 10086->10087 10088 40245c 10087->10088 10090 40246d 10088->10090 10822 402415 LoadLibraryA GetProcAddress 10088->10822 10090->9605 10091->9605 10093 401484 2 API calls 10092->10093 10094 405082 10093->10094 10095 401484 2 API calls 10094->10095 10096 40508a GetCommandLineW 10095->10096 10097 404ac6 2 API calls 10096->10097 10098 40509a 10097->10098 10099 4048d8 2 API calls 10098->10099 10100 4050cd 10099->10100 10101 4048f6 2 API calls 10100->10101 10102 4050da 10101->10102 10103 4048f6 2 API calls 10102->10103 10104 4050e7 10103->10104 10105 404914 2 API calls 10104->10105 10106 4050f4 10105->10106 10107 404914 2 API calls 10106->10107 10108 405101 10107->10108 10109 404914 2 API calls 10108->10109 10110 40510e 10109->10110 10111 404914 2 API calls 10110->10111 10112 40511b 10111->10112 10113 4048f6 2 API calls 10112->10113 10114 405128 10113->10114 10115 4048f6 2 API calls 10114->10115 10116 405135 10115->10116 10117 4048f6 2 API calls 10116->10117 10118 405142 10117->10118 10119 4013d5 2 API calls 10118->10119 10120 40514e 12 API calls 10119->10120 10121 4051e3 GetLastError 10120->10121 10122 405206 CreateJobObjectW 10120->10122 10123 4051eb ??3@YAXPAX ??3@YAXPAX 10121->10123 10124 405281 ResumeThread WaitForSingleObject 10122->10124 10125 40521e AssignProcessToJobObject 10122->10125 10123->9615 10126 405291 CloseHandle GetExitCodeProcess 10124->10126 10125->10124 10127 40522c CreateIoCompletionPort 10125->10127 10128 4052b7 CloseHandle 10126->10128 10129 4052ae GetLastError 10126->10129 10127->10124 10130 40523e SetInformationJobObject ResumeThread 10127->10130 10131 4052c0 CloseHandle 10128->10131 10132 4052c3 10128->10132 10129->10128 10133 40526c GetQueuedCompletionStatus 10130->10133 10131->10132 10134 4052c9 CloseHandle 10132->10134 10135 4052ce 10132->10135 10133->10124 10136 405266 10133->10136 10134->10135 10135->10123 10136->10126 10136->10133 10138 402405 10137->10138 10139 4023ea LoadLibraryA GetProcAddress 10137->10139 10138->9601 10139->10138 10141 407cb6 4 API calls 10140->10141 10142 4044cb 10141->10142 10142->9534 10143->9515 10145 4054e5 ??3@YAXPAX 10144->10145 10146 405349 10144->10146 10148 4054eb 10145->10148 10146->10145 10147 40535d GetDriveTypeW 10146->10147 10147->10145 10149 405389 10147->10149 10148->9518 10150 404571 6 API calls 10149->10150 10151 405397 CreateFileW 10150->10151 10152 4053bd 10151->10152 10153 4054af ??3@YAXPAX ??3@YAXPAX 10151->10153 10154 401484 2 API calls 10152->10154 10153->10148 10155 4053c6 10154->10155 10156 40139c 2 API calls 10155->10156 10157 4053d3 10156->10157 10158 4027ee 2 API calls 10157->10158 10159 4053e1 10158->10159 10160 401455 2 API calls 10159->10160 10161 4053ed 10160->10161 10162 4027ee 2 API calls 10161->10162 10163 4053fb 10162->10163 10164 4027ee 2 API calls 10163->10164 10165 405408 10164->10165 10166 401455 2 API calls 10165->10166 10167 405414 10166->10167 10168 4027ee 2 API calls 10167->10168 10169 405421 10168->10169 10170 4027ee 2 API calls 10169->10170 10171 40542a 10170->10171 10172 401455 2 API calls 10171->10172 10173 405436 10172->10173 10174 4027ee 2 API calls 10173->10174 10175 40543f 10174->10175 10176 402b4c 3 API calls 10175->10176 10177 405451 WriteFile ??3@YAXPAX CloseHandle 10176->10177 10178 4054c0 10177->10178 10179 40547f 10177->10179 10181 40301f 16 API calls 10178->10181 10179->10178 10180 405487 SetFileAttributesW ShellExecuteW ??3@YAXPAX 10179->10180 10180->10153 10182 4054c8 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 10181->10182 10182->10148 10192 40253b 10183->10192 10187 401484 2 API calls 10186->10187 10188 402b10 10187->10188 10189 402b48 10188->10189 10190 4027d6 2 API calls 10188->10190 10189->9655 10191 402b2d MultiByteToWideChar 10190->10191 10191->10189 10193 402575 10192->10193 10194 402549 ??2@YAPAXI 10192->10194 10193->9655 10194->10193 10195 40255a ??3@YAXPAX 10194->10195 10195->10193 10198 401cee 10197->10198 10200 401cae 10197->10200 10198->9662 10199 40c271 CharUpperW 10199->10200 10200->10198 10200->10199 10201 401cfb 10200->10201 10205 40c271 CharUpperW 10201->10205 10203 401d0b 10206 40c271 CharUpperW 10203->10206 10205->10203 10206->10198 10207->9687 10209 4023c8 10208->10209 10210 4023bc GetNativeSystemInfo 10208->10210 10209->9693 10210->9693 10214 40bf55 10211->10214 10215 40bf1c 2 API calls 10214->10215 10216 405c0f 10215->10216 10216->9354 10216->9355 10267 4028e5 10217->10267 10220 4028e5 2 API calls 10221 403bf5 10220->10221 10271 402a39 10221->10271 10224 40291f 2 API calls 10225 403c12 ??3@YAXPAX 10224->10225 10226 402a39 3 API calls 10225->10226 10227 403c2d 10226->10227 10228 40291f 2 API calls 10227->10228 10229 403c38 ??3@YAXPAX 10228->10229 10230 403c78 10229->10230 10231 403c4e 10229->10231 10233 403ca5 10230->10233 10234 403c7e wsprintfA 10230->10234 10231->10230 10232 403c53 wsprintfA 10231->10232 10237 40297f 2 API calls 10232->10237 10236 40297f 2 API calls 10233->10236 10235 40297f 2 API calls 10234->10235 10238 403c9a 10235->10238 10239 403cb2 10236->10239 10240 403c6d 10237->10240 10241 40297f 2 API calls 10238->10241 10242 40297f 2 API calls 10239->10242 10243 40297f 2 API calls 10240->10243 10241->10233 10244 403cba 10242->10244 10243->10230 10245 402c1a 10244->10245 10246 402c27 10245->10246 10254 40c5fe 3 API calls 10246->10254 10247 402c39 lstrlenA lstrlenA 10252 402c66 10247->10252 10248 402d11 memmove 10251 402d44 10248->10251 10248->10252 10249 402cee memcmp 10249->10252 10250 402cb1 memcmp 10250->10251 10250->10252 10256 40291f 10251->10256 10252->10248 10252->10249 10252->10250 10252->10251 10255 40c5ca GetLastError 10252->10255 10286 402957 10252->10286 10254->10247 10255->10252 10257 40292b 10256->10257 10259 40293c 10256->10259 10258 40253b 2 API calls 10257->10258 10258->10259 10259->9721 10261 402587 2 API calls 10260->10261 10262 4029c5 10261->10262 10262->9728 10264 40298e 10263->10264 10265 402587 2 API calls 10264->10265 10266 40299b 10265->10266 10266->9721 10268 4028fb 10267->10268 10269 40253b 2 API calls 10268->10269 10270 402908 10269->10270 10270->10220 10273 402a54 10271->10273 10272 402a6b 10274 40284f 2 API calls 10272->10274 10273->10272 10275 402a60 10273->10275 10277 402a74 10274->10277 10283 402897 10275->10283 10279 40253b 2 API calls 10277->10279 10278 402a69 10278->10224 10280 402a7d 10279->10280 10281 402897 2 API calls 10280->10281 10282 402aab ??3@YAXPAX 10281->10282 10282->10278 10284 40253b 2 API calls 10283->10284 10285 4028b2 10284->10285 10285->10278 10289 402587 10286->10289 10290 4025cb 10289->10290 10291 40259b 10289->10291 10290->10252 10292 40253b 2 API calls 10291->10292 10292->10290 10294 4043f0 10293->10294 10305 404316 10294->10305 10298 404386 10297->10298 10299 404316 _wtol 10298->10299 10300 4043a7 10299->10300 10300->9766 10302 4043b7 10301->10302 10303 404316 _wtol 10302->10303 10304 4043cf 10303->10304 10304->9774 10308 404320 10305->10308 10306 40433b _wtol 10306->10308 10307 404374 10307->9760 10308->10306 10308->10307 10310 402651 10309->10310 10311 40267a 10310->10311 10312 40265d lstrcmpW 10310->10312 10311->9447 10312->10310 10312->10311 10341 4103d0 10313->10341 10349 40f93c _EH_prolog 10313->10349 10314 40112a 10314->9802 10314->9806 10318 401650 10317->10318 10319 40139c 2 API calls 10318->10319 10320 40165d 10319->10320 10321 401552 2 API calls 10320->10321 10322 401666 CreateThread 10321->10322 10323 401695 10322->10323 10324 40169a WaitForSingleObject 10322->10324 10748 40130f 10322->10748 10325 408532 25 API calls 10323->10325 10326 4016b7 10324->10326 10327 4016e9 10324->10327 10325->10324 10328 4016d5 10326->10328 10332 4016c6 10326->10332 10329 4016f1 GetExitCodeThread 10327->10329 10330 4016e5 10327->10330 10333 408dd2 57 API calls 10328->10333 10331 401708 10329->10331 10330->9814 10331->10330 10331->10332 10334 401737 SetLastError 10331->10334 10332->10330 10335 408dd2 57 API calls 10332->10335 10333->10330 10334->10332 10335->10330 10337 401484 2 API calls 10336->10337 10338 4014b5 10337->10338 10339 401484 2 API calls 10338->10339 10340 4014c1 10339->10340 10340->9809 10342 4103e2 10341->10342 10347 40c5fe 3 API calls 10342->10347 10343 4103f6 10344 41042d 10343->10344 10348 40c5fe 3 API calls 10343->10348 10344->10314 10345 41040a 10345->10344 10365 410275 10345->10365 10347->10343 10348->10345 10350 40f95c 10349->10350 10351 4103d0 11 API calls 10350->10351 10352 40f981 10351->10352 10353 40f9a3 10352->10353 10354 40f98a 10352->10354 10393 411d7e _EH_prolog 10353->10393 10396 40f55c 10354->10396 10378 40d650 10365->10378 10367 4102a1 10367->10344 10368 41028d 10368->10367 10381 40d5b6 10368->10381 10371 41036e ??3@YAXPAX 10371->10367 10373 410357 memmove 10374 4102da 10373->10374 10374->10371 10374->10373 10375 410383 memcpy 10374->10375 10376 410379 ??3@YAXPAX 10374->10376 10377 40c5fe 3 API calls 10375->10377 10376->10367 10377->10376 10389 40d605 10378->10389 10382 40d600 memcpy 10381->10382 10383 40d5c3 10381->10383 10382->10374 10384 40d5c8 ??2@YAPAXI 10383->10384 10385 40d5ee 10383->10385 10386 40d5f0 ??3@YAXPAX 10384->10386 10387 40d5d8 memmove 10384->10387 10385->10386 10386->10382 10387->10386 10390 40d649 10389->10390 10391 40d617 10389->10391 10390->10368 10391->10390 10392 40c5ca GetLastError 10391->10392 10392->10391 10404 411af9 10393->10404 10731 40f3ec 10396->10731 10426 40f21d 10404->10426 10549 40f18e 10426->10549 10550 40c397 ctype 10 API calls 10549->10550 10551 40f197 10550->10551 10552 40c397 ctype 10 API calls 10551->10552 10553 40f19f 10552->10553 10554 40c397 ctype 10 API calls 10553->10554 10555 40f1a7 10554->10555 10556 40c397 ctype 10 API calls 10555->10556 10557 40f1af 10556->10557 10558 40c397 ctype 10 API calls 10557->10558 10559 40f1b7 10558->10559 10560 40c397 ctype 10 API calls 10559->10560 10561 40f1bf 10560->10561 10562 40c397 ctype 10 API calls 10561->10562 10563 40f1c9 10562->10563 10564 40c397 ctype 10 API calls 10563->10564 10565 40f1d1 10564->10565 10566 40c397 ctype 10 API calls 10565->10566 10567 40f1de 10566->10567 10568 40c397 ctype 10 API calls 10567->10568 10569 40f1e6 10568->10569 10570 40c397 ctype 10 API calls 10569->10570 10571 40f1f3 10570->10571 10572 40c397 ctype 10 API calls 10571->10572 10573 40f1fb 10572->10573 10574 40c397 ctype 10 API calls 10573->10574 10575 40f208 10574->10575 10576 40c397 ctype 10 API calls 10575->10576 10577 40f210 10576->10577 10732 40c397 ctype 10 API calls 10731->10732 10733 40f3fa 10732->10733 10749 401318 10748->10749 10751 40132b 10748->10751 10750 40131a Sleep 10749->10750 10749->10751 10750->10749 10752 401364 10751->10752 10753 401356 EndDialog 10751->10753 10753->10752 10754->9842 10756 4026c3 10755->10756 10757 40269b lstrcmpW 10755->10757 10756->9892 10758 4026b2 10757->10758 10758->10756 10758->10757 10759->9892 10761 402d77 10760->10761 10762 402d6b 10760->10762 10764 40284f 2 API calls 10761->10764 10778 401c0b GetStdHandle WriteFile 10762->10778 10768 402d81 10764->10768 10765 402d72 10777 4026c6 ??3@YAXPAX ??3@YAXPAX 10765->10777 10766 402dac 10767 402b04 3 API calls 10766->10767 10769 402dbe 10767->10769 10768->10766 10772 402957 2 API calls 10768->10772 10770 402de0 10769->10770 10771 402dcc 10769->10771 10774 408dd2 57 API calls 10770->10774 10773 408dd2 57 API calls 10771->10773 10772->10768 10775 402ddb ??3@YAXPAX ??3@YAXPAX 10773->10775 10774->10775 10775->10765 10777->9899 10778->10765 10780 40136a 2 API calls 10779->10780 10781 4029f1 10780->10781 10782 40136a 2 API calls 10781->10782 10783 4029fd 10782->10783 10783->9915 10785 40284f 2 API calls 10784->10785 10786 402b5b 10785->10786 10787 402b97 10786->10787 10790 4028cd 10786->10790 10787->9942 10791 4028d9 10790->10791 10792 4028df WideCharToMultiByte 10790->10792 10793 40253b 2 API calls 10791->10793 10792->10787 10793->10792 10795 407da1 10794->10795 10796 407d9c 10794->10796 10795->10796 10797 407d17 22 API calls 10795->10797 10796->10000 10797->10796 10798->10000 10799->10006 10800->10008 10801->10010 10802->10012 10803->10016 10804->10020 10805->10024 10806->10027 10808 407cb6 4 API calls 10807->10808 10809 407e71 10808->10809 10809->10038 10814 407e82 10810->10814 10813->10042 10815 407cb6 4 API calls 10814->10815 10816 407e8a 10815->10816 10816->10039 10817->10050 10819 407cb6 4 API calls 10818->10819 10820 407ebc 10819->10820 10820->10068 10821->10071 10823 402437 10822->10823 10823->10091 8816 40b990 8817 40b9ad 8816->8817 8818 40b9bc 8817->8818 8821 409f70 8817->8821 8822 409f7a 8821->8822 8826 409f9a 8822->8826 8827 401d3f 8822->8827 8825 402788 48 API calls 8825->8826 8828 401d46 free 8827->8828 8829 401d4c 8827->8829 8828->8829 8829->8825 9252 40159b 9253 4015b8 9252->9253 9254 4015a8 9252->9254 9257 401521 ??3@YAXPAX 9254->9257 9258 401534 9257->9258 9259 40153a ??3@YAXPAX 9257->9259 9258->9259 9260 40154a ??3@YAXPAX 9259->9260 9260->9253 8830 40bfa2 ReadFile

                                                                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                                                                              Function 00405750 Relevance: 231.1, APIs: 93, Strings: 38, Instructions: 1811keyboardwindowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405763
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401D4D: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401D59
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401D4D: CreateWindowExW.USER32(00000000,Static,004144C8,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401D76
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401D4D: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401D88
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401D4D: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401D95
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401D4D: DispatchMessageW.USER32(?), ref: 00401D9F
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401D4D: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401DA8
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401D4D: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401DAF
                                                                                                                                                                                                                                                                                              • GetVersionExW.KERNEL32(?,?,00000000), ref: 00405780
                                                                                                                                                                                                                                                                                              • GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 00405811
                                                                                                                                                                                                                                                                                                • Part of subcall function 00402E02: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831,00000000), ref: 00402E75
                                                                                                                                                                                                                                                                                                • Part of subcall function 00402E02: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831), ref: 00402E90
                                                                                                                                                                                                                                                                                                • Part of subcall function 00402E02: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?), ref: 00402E98
                                                                                                                                                                                                                                                                                                • Part of subcall function 00402E02: ??3@YAXPAX@Z.MSVCRT(00405831,00405831,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831,00000000,00000000), ref: 00402F08
                                                                                                                                                                                                                                                                                                • Part of subcall function 00404424: lstrlenW.KERNEL32(00405844,00000000,00000020,-00000002,00405844,-00000002,00000000,00000000,00000000), ref: 00404458
                                                                                                                                                                                                                                                                                                • Part of subcall function 00404424: lstrlenW.KERNEL32(?), ref: 00404460
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 00405854
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,00418818,00418818), ref: 004058A6
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00418818,00418818), ref: 004058BA
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00418818,00418818), ref: 004058C2
                                                                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,00000208,00000000,00000000), ref: 00405938
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 00405A54
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000010,00000000,00418818,00418818), ref: 00405BDC
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,00000000,00418818,00418818), ref: 00405C5F
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,00000000,00418818,00418818), ref: 00405CD5
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00418818,00418818), ref: 00405CF1
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,00418818,00418818), ref: 00405D2F
                                                                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00405D59
                                                                                                                                                                                                                                                                                                • Part of subcall function 00403305: ??2@YAPAXI@Z.MSVCRT(00000018,00000000,00404A21,?,?,?), ref: 0040330A
                                                                                                                                                                                                                                                                                                • Part of subcall function 004026C6: ??3@YAXPAX@Z.MSVCRT(?,-00000008,00404A61,?,?,?), ref: 004026CC
                                                                                                                                                                                                                                                                                                • Part of subcall function 004026C6: ??3@YAXPAX@Z.MSVCRT(?,?,-00000008,00404A61,?,?,?), ref: 004026D3
                                                                                                                                                                                                                                                                                              • GetCommandLineW.KERNEL32(?,?,00000000,0000000A), ref: 0040607D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00404247: lstrlenW.KERNEL32(|g@,00000000,?,00000000,0040428E,00000000,00000000,0040677C,?,waitall,00000000,00000000,?,?,004187D0), ref: 00404254
                                                                                                                                                                                                                                                                                                • Part of subcall function 00404247: lstrlenW.KERNEL32(?,?,?,004187D0), ref: 0040425D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00404247: _wcsnicmp.MSVCRT ref: 00404269
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 00405F9A
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 004060F5
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 004060FD
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00406105
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 0040610D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 00406115
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 00406121
                                                                                                                                                                                                                                                                                              • SetProcessWorkingSetSize.KERNEL32(00000000), ref: 00406128
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 00406145
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040614D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406155
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040615D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000A), ref: 0040617C
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 00406196
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040619E
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004061A6
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004061AE
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000002,?,00000000,?,00000000,0000000A), ref: 0040625D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,?,?,00000000,0000000A), ref: 004062F4
                                                                                                                                                                                                                                                                                              • CoInitialize.OLE32(00000000), ref: 00406321
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 00406367
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 00406389
                                                                                                                                                                                                                                                                                              • GetKeyState.USER32(00000010), ref: 004063ED
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 00406527
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 00406535
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 0040655E
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406566
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 00406582
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 0040658A
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 004065BA
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,004187D0), ref: 004065FA
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,004187D0), ref: 00406663
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,004187D0), ref: 0040666B
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,004187D0), ref: 00406730
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,004187D0), ref: 0040673B
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,004187D0), ref: 00406745
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,004187D0), ref: 004067FF
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,004187D0), ref: 00406807
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 0040689B
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?), ref: 00406A7A
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?,?,?,?), ref: 00406A82
                                                                                                                                                                                                                                                                                                • Part of subcall function 00404F96: memset.MSVCRT ref: 00404FBA
                                                                                                                                                                                                                                                                                                • Part of subcall function 00404F96: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,00000000), ref: 00405013
                                                                                                                                                                                                                                                                                                • Part of subcall function 00404F96: ??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 0040501B
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406AA6
                                                                                                                                                                                                                                                                                                • Part of subcall function 004023E1: LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00406ACC,00000000,?,?), ref: 004023F4
                                                                                                                                                                                                                                                                                                • Part of subcall function 004023E1: GetProcAddress.KERNEL32(00000000), ref: 004023FB
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00406AEF
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406AF7
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406AFF
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00406B05
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406B8F
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?), ref: 00406BB0
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?), ref: 00406BB8
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?), ref: 00406BC0
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?), ref: 00406BC6
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?), ref: 00406BCE
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?), ref: 00406BD6
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?), ref: 00406BDE
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00406BFD
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406C05
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406C0D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00406C13
                                                                                                                                                                                                                                                                                              • SetCurrentDirectoryW.KERNELBASE(?,?,?,?,?,?,00000000,?,?), ref: 00406C4C
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406C76
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,0000000A), ref: 00406282
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407D17: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00407D77
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407D17: ??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00407D7F
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407A8A: ??3@YAXPAX@Z.MSVCRT(?,00408584,00000002,00000000,004187D0), ref: 00407A93
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406D3A
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406D42
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,?,?), ref: 00406D59
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406D6D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406D75
                                                                                                                                                                                                                                                                                              • MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 00406D8E
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$_wtol$lstrlen$Message$??2@CommandCurrentFileLineModuleProcessTimer$?_set_new_handler@@AddressAttributesCallbackCreateDirectoryDispatchDispatcherHandleInitializeKillLibraryLoadNameProcSizeStateUserVersionWindowWorking_wcsnicmpmemsetwsprintf
                                                                                                                                                                                                                                                                                              • String ID: " -$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$setup.exe$sfxconfig$sfxelevation$sfxversion$sfxwaitall$shc$waitall$x64$x86
                                                                                                                                                                                                                                                                                              • API String ID: 1141480454-1804565692
                                                                                                                                                                                                                                                                                              • Opcode ID: 70ada06d190f9b080b1a6555411ee1e451d72c36f217fb2ecdd21aa89c461c22
                                                                                                                                                                                                                                                                                              • Instruction ID: 839f8ad789dc81d3af8c82f495bd702834d4a62b9ebc11d4b30192562ff1c903
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 70ada06d190f9b080b1a6555411ee1e451d72c36f217fb2ecdd21aa89c461c22
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E9D2DE71904208AADB10AF61DD46AEF37A8EF40318F54403FF906B61E1EB7D99A1CB5D
                                                                                                                                                                                                                                                                                              Function 0040239B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 905 40239b-4023ba LoadLibraryA GetProcAddress 906 4023c8-4023cb 905->906 907 4023bc-4023c7 GetNativeSystemInfo 905->907
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,004023D1,00405BCF,00418818,00418818), ref: 004023AB
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 004023B2
                                                                                                                                                                                                                                                                                              • GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,004023D1,00405BCF,00418818,00418818), ref: 004023C0
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressInfoLibraryLoadNativeProcSystem
                                                                                                                                                                                                                                                                                              • String ID: GetNativeSystemInfo$kernel32
                                                                                                                                                                                                                                                                                              • API String ID: 2103483237-3846845290
                                                                                                                                                                                                                                                                                              • Opcode ID: 29c8b91972701315efc4f7d7d8bddbd6f250053e02b88915a068c2978826be41
                                                                                                                                                                                                                                                                                              • Instruction ID: afd952334ce5608e5f84ab2444d6511bb433925e4e51cff7b4d4dc1f25dbb455
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 29c8b91972701315efc4f7d7d8bddbd6f250053e02b88915a068c2978826be41
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 35D05EB070030877CB10EBB56D0EADB32F859C8B487100461A902F10C0EABCDE80C378
                                                                                                                                                                                                                                                                                              Function 004033B3 Relevance: 7.5, APIs: 5, Instructions: 45COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 947 4033b3-4033ca GetFileAttributesW 948 4033d0-4033d2 947->948 949 4033cc-4033ce 947->949 951 4033e1-4033e8 948->951 952 4033d4-4033df SetLastError 948->952 950 403429-40342b 949->950 953 4033f3-4033f6 951->953 954 4033ea-4033f1 call 403386 951->954 952->950 956 403426-403428 953->956 957 4033f8-403409 FindFirstFileW 953->957 954->950 956->950 957->954 959 40340b-403424 FindClose CompareFileTime 957->959 959->954 959->956
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNELBASE(?,-00000001), ref: 004033C1
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000010), ref: 004033D6
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AttributesErrorFileLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1799206407-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7f02d877fe96693e79d52cb70461d1cf76c14600a7221cb4648c6da81f4608cf
                                                                                                                                                                                                                                                                                              • Instruction ID: 608ba71f646b69bc36d7accade446189952d3e61ba5e6ec9fefd2cffda7f1f25
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7f02d877fe96693e79d52cb70461d1cf76c14600a7221cb4648c6da81f4608cf
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A01D6315001156BDB105FB4AC8D9DA3B5CAF51327F504632F922F11E0EB38D741465D
                                                                                                                                                                                                                                                                                              Function 004011FD Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 00401219
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00008001,00000000,?), ref: 00401272
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: DiskFreeMessageSendSpace
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 696007252-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 76c877f8e4e04b6b1800e0e3c37e02ee1ef8b0dd0ed0dfcb9a9652151f192eb4
                                                                                                                                                                                                                                                                                              • Instruction ID: 6537aa89ce628f24a2eb9e1cdbee530b0aed1928fb96dd1290126444b22a0e58
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 76c877f8e4e04b6b1800e0e3c37e02ee1ef8b0dd0ed0dfcb9a9652151f192eb4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A4016D31214208AAEB11DB60DD85F9A37A9EB40700F6081BEF511FA1E0CB79A9508B1D
                                                                                                                                                                                                                                                                                              Function 00401841 Relevance: 22.8, APIs: 15, Instructions: 304COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 724 401841-401851 725 401853-401858 724->725 726 40185d-401888 call 40d7d7 call 40f78d 724->726 727 401b9b-401b9e 725->727 731 40188a 726->731 732 40189b-4018a7 call 401484 726->732 733 40188c-401896 call 40c125 731->733 738 401b7d-401b98 ??3@YAXPAX@Z call 40c125 732->738 739 4018ad-4018b2 732->739 740 401b9a 733->740 738->740 739->738 741 4018b8-4018ee call 40139c call 40157d call 4013d5 ??3@YAXPAX@Z 739->741 740->727 751 401b63-401b66 741->751 752 4018f4-401913 741->752 753 401b68-401b7b ??3@YAXPAX@Z call 40c125 751->753 756 401915-401929 call 40c125 ??3@YAXPAX@Z 752->756 757 40192e-401932 752->757 753->740 756->733 760 401934-401937 757->760 761 401939-40193e 757->761 763 401966-40197d 760->763 764 401960-401963 761->764 765 401940 761->765 763->756 768 40197f-4019a2 763->768 764->763 766 401942-401948 765->766 770 40194a-40195b call 40c125 ??3@YAXPAX@Z 766->770 773 4019a4-4019b8 call 40c125 ??3@YAXPAX@Z 768->773 774 4019bd-4019c3 768->774 770->733 773->733 777 4019c5-4019c8 774->777 778 4019df-4019f1 GetLocalTime SystemTimeToFileTime 774->778 780 4019d1-4019dd 777->780 781 4019ca-4019cc 777->781 782 4019f7-4019fa 778->782 780->782 781->766 783 401a13-401a1a call 4033b3 782->783 784 4019fc-401a06 call 40371d 782->784 788 401a1f-401a24 783->788 784->770 789 401a0c-401a0e 784->789 790 401a2a-401a2d 788->790 791 401b4f-401b5e GetLastError 788->791 789->766 792 401a33-401a3d ??2@YAPAXI@Z 790->792 793 401b45-401b48 790->793 791->751 795 401a4e 792->795 796 401a3f-401a4c 792->796 793->791 797 401a50-401a74 call 401132 call 40c019 795->797 796->797 802 401b2a-401b43 call 40114b call 40c125 797->802 803 401a7a-401a98 GetLastError call 40136a call 4030f3 797->803 802->753 812 401ad5-401aea call 40371d 803->812 813 401a9a-401aa1 803->813 819 401af6-401b0e call 40c019 812->819 820 401aec-401af4 812->820 815 401aa5-401ab5 ??3@YAXPAX@Z 813->815 817 401ab7-401ab9 815->817 818 401abd-401ad0 call 40c125 ??3@YAXPAX@Z 815->818 817->818 818->733 826 401b10-401b1f GetLastError 819->826 827 401b21-401b29 ??3@YAXPAX@Z 819->827 820->815 826->815 827->802
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                                                                              • Opcode ID: 451186c113f653c617f2b4c303cd8cc1d100b7aa9b3bcf13a371010ef4c090fb
                                                                                                                                                                                                                                                                                              • Instruction ID: 0cae968632e73b1968c90da9ca4dea23e5e4de3726d7a027592f3d205df29353
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 451186c113f653c617f2b4c303cd8cc1d100b7aa9b3bcf13a371010ef4c090fb
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22B14A71900209EFCB14EFA5D8849EEB7B5FF44314B10852BF412BB2A1EB78A945CB58
                                                                                                                                                                                                                                                                                              Function 00412DCF Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 830 412dcf-412e44 __set_app_type __p__fmode __p__commode call 412f5b 833 412e52-412ea9 call 412f46 _initterm __getmainargs _initterm 830->833 834 412e46-412e51 __setusermatherr 830->834 837 412ee5-412ee8 833->837 838 412eab-412eb3 833->838 834->833 841 412ec2-412ec6 837->841 842 412eea-412eee 837->842 839 412eb5-412eb7 838->839 840 412eb9-412ebc 838->840 839->838 839->840 840->841 843 412ebe-412ebf 840->843 844 412ec8-412eca 841->844 845 412ecc-412edd GetStartupInfoA 841->845 842->837 843->841 844->843 844->845 846 412ef0-412ef2 845->846 847 412edf-412ee3 845->847 848 412ef3-412f20 GetModuleHandleA call 406da1 exit _XcptFilter 846->848 847->848
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 801014965-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 329fb5ec40b1a3e22881c27b52012f5837425f84134cca069eaa34249d5edeef
                                                                                                                                                                                                                                                                                              • Instruction ID: 4f71473f6c996e876dfffe8074da0a06471e4f97bcacb5e315fccfc2763ddc53
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 329fb5ec40b1a3e22881c27b52012f5837425f84134cca069eaa34249d5edeef
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B241AEB4940348AFCB209FA4DD49AEA7BB8FB49710F20412FF841D7291DBB849D1DB59
                                                                                                                                                                                                                                                                                              Function 00401D4D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47timewindowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401D59
                                                                                                                                                                                                                                                                                              • CreateWindowExW.USER32(00000000,Static,004144C8,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401D76
                                                                                                                                                                                                                                                                                              • SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401D88
                                                                                                                                                                                                                                                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401D95
                                                                                                                                                                                                                                                                                              • DispatchMessageW.USER32(?), ref: 00401D9F
                                                                                                                                                                                                                                                                                              • KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401DA8
                                                                                                                                                                                                                                                                                              • KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401DAF
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
                                                                                                                                                                                                                                                                                              • String ID: Static
                                                                                                                                                                                                                                                                                              • API String ID: 2479445380-2272013587
                                                                                                                                                                                                                                                                                              • Opcode ID: 003be153fc8e0c227edcd4b239f3674ac5eb22499557d269a0105fd8ff32caa2
                                                                                                                                                                                                                                                                                              • Instruction ID: eff3e12e9f1823bf2594ac1749915e0bfe43eaadbfefd36aad20e809da0bd704
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 003be153fc8e0c227edcd4b239f3674ac5eb22499557d269a0105fd8ff32caa2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AAF0F4715421257BDA202BA6AC4DFDF3E6CDFC6BB2F114261FA19A10D0DA784081C6B9
                                                                                                                                                                                                                                                                                              Function 0040371D Relevance: 10.6, APIs: 7, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 854 40371d-403743 lstrlenW call 40279d 857 403745-403749 call 40119e 854->857 858 40374e-40375a 854->858 857->858 860 403762-403768 858->860 861 40375c-403760 858->861 862 40376b-40376d 860->862 861->860 861->862 863 403791-40379a call 401ba1 862->863 866 403780-403782 863->866 867 40379c-4037af GetSystemTimeAsFileTime GetFileAttributesW 863->867 868 403784-403786 866->868 869 40376f-403777 866->869 870 4037b1-4037bf call 4033b3 867->870 871 4037c8-4037d1 call 401ba1 867->871 873 403840-403846 868->873 874 40378c 868->874 869->868 872 403779-40377d 869->872 870->871 886 4037c1-4037c3 870->886 882 4037e2-4037e4 871->882 883 4037d3-4037e0 call 408dd2 871->883 872->868 880 40377f 872->880 878 403870-403883 call 408dd2 ??3@YAXPAX@Z 873->878 879 403848-403853 873->879 874->863 893 403885-403889 878->893 879->878 884 403855-403859 879->884 880->866 889 403834-40383e ??3@YAXPAX@Z 882->889 890 4037e6-403805 memcpy 882->890 883->886 884->878 888 40385b-403860 884->888 892 403865-40386e ??3@YAXPAX@Z 886->892 888->878 895 403862-403864 888->895 889->893 896 403807 890->896 897 40381a-40381e 890->897 892->893 895->892 898 403819 896->898 899 403820-40382d call 401ba1 897->899 900 403809-403811 897->900 898->897 899->883 904 40382f-403832 899->904 900->899 901 403813-403817 900->901 901->898 901->899 904->889 904->890
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • lstrlenW.KERNEL32(004017FB,00000000,?,?,?,?,?,?,004017FB,?), ref: 0040372A
                                                                                                                                                                                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(?,004017FB,?,?,?,?,004017FB,?), ref: 004037A0
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017FB,?), ref: 004037A7
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,004017FB,?,?,?,?,004017FB,?), ref: 00403866
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040119E: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011BE
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040119E: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011E4
                                                                                                                                                                                                                                                                                              • memcpy.MSVCRT(-00000001,004017FB,?,?,?,?,?,004017FB,?), ref: 004037F8
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,004017FB,?), ref: 00403835
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,004017FB,004017FB,?,?,?,?,004017FB,?), ref: 0040387B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 846840743-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 75e82deebf4219ee601feba78d368a50ad9d49ea69c3682dd46ef2bf704f6b93
                                                                                                                                                                                                                                                                                              • Instruction ID: 3276eaba2f91510ab784efe6cdcb99c4529a15556bd6a795246fe739cc12f76e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75e82deebf4219ee601feba78d368a50ad9d49ea69c3682dd46ef2bf704f6b93
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB41EBB6900115A6D720BF698945ABF7BBCEF00716F50817BF901B32C1E77C9A4242ED
                                                                                                                                                                                                                                                                                              Function 00410275 Relevance: 7.6, APIs: 5, Instructions: 141COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 908 410275-410292 call 40d650 911 410298-41029f call 40fd7e 908->911 912 4103ca-4103cd 908->912 915 4102a1-4102a3 911->915 916 4102a8-4102d7 call 40d5b6 memcpy 911->916 915->912 919 4102da-4102e2 916->919 920 4102e4-4102f2 919->920 921 4102fa-410312 919->921 922 4102f4 920->922 923 41036e-410377 ??3@YAXPAX@Z 920->923 927 410314-410319 921->927 928 410379 921->928 922->921 926 4102f6-4102f8 922->926 924 4103c8-4103c9 923->924 924->912 926->921 926->923 930 41031b-410323 927->930 931 41037e-410381 927->931 929 41037b-41037c 928->929 932 4103c1-4103c6 ??3@YAXPAX@Z 929->932 933 410325 930->933 934 410357-410369 memmove 930->934 931->929 932->924 935 410334-410338 933->935 934->919 936 41033a-41033c 935->936 937 41032c-41032e 935->937 936->934 939 41033e-410347 call 40fd7e 936->939 937->934 938 410330-410331 937->938 938->935 942 410383-4103b9 memcpy call 40c5fe 939->942 943 410349-410355 939->943 945 4103bc-4103bf 942->945 943->934 944 410327-41032a 943->944 944->935 945->932
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • memcpy.MSVCRT(00000000,?,00000020,00010000), ref: 004102CC
                                                                                                                                                                                                                                                                                              • memmove.MSVCRT(00000000,?,00000020,?,00010000), ref: 00410363
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0041036F
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@memcpymemmove
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3549172513-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 6b02684eeb5e7b41fb38fd2ca6da54966698f13f169ef9e7084ae70f98d405d5
                                                                                                                                                                                                                                                                                              • Instruction ID: 63a56fa8281db28ad90281e808061650b4139096c2ab0ad2d55df77e1dad3be2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6b02684eeb5e7b41fb38fd2ca6da54966698f13f169ef9e7084ae70f98d405d5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B41A171A00208ABDB24DFA5C944AEEB7B4FF44744F14456EE841E7241D7B8EEC18B59
                                                                                                                                                                                                                                                                                              Function 0040E827 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 388COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 960 40e827-40e86f _EH_prolog call 401132 963 40e871-40e874 960->963 964 40e877-40e87a 960->964 963->964 965 40e890-40e8b5 964->965 966 40e87c-40e881 964->966 967 40e8b7-40e8bd 965->967 968 40e883-40e885 966->968 969 40e889-40e88b 966->969 970 40e8c3-40e8c7 967->970 971 40e987-40e99a call 4011fd 967->971 968->969 972 40ecf3-40ed04 969->972 973 40e8c9-40e8cc 970->973 974 40e8cf-40e8de 970->974 981 40e9b1-40e9d6 call 40deaa ??2@YAPAXI@Z 971->981 982 40e99c-40e9a6 call 40e585 971->982 973->974 975 40e8e0-40e8f6 call 40e640 call 40e7fd call 40c419 974->975 976 40e903-40e908 974->976 998 40e8fb-40e901 975->998 979 40e916-40e950 call 40e640 call 40e7fd call 40c419 call 40e717 976->979 980 40e90a-40e914 976->980 985 40e953-40e969 979->985 980->979 980->985 994 40e9e1-40e9fa call 401132 call 40d1d1 981->994 995 40e9d8-40e9df call 40d2a4 981->995 1000 40e9aa-40e9ac 982->1000 991 40e96c-40e974 985->991 997 40e976-40e985 call 40e563 991->997 991->998 1014 40e9fd-40ea20 call 40d1c6 994->1014 995->994 997->991 998->967 1000->972 1017 40ea22-40ea27 1014->1017 1018 40ea56-40ea59 1014->1018 1019 40ea29-40ea2b 1017->1019 1020 40ea2f-40ea47 call 40e690 call 40e585 1017->1020 1021 40ea85-40eaa9 ??2@YAPAXI@Z 1018->1021 1022 40ea5b-40ea60 1018->1022 1019->1020 1040 40ea49-40ea4b 1020->1040 1041 40ea4f-40ea51 1020->1041 1024 40eab4 1021->1024 1025 40eaab-40eab2 call 40ed7f 1021->1025 1026 40ea62-40ea64 1022->1026 1027 40ea68-40ea7e call 40e690 call 40e585 1022->1027 1031 40eab6-40eacd call 401132 1024->1031 1025->1031 1026->1027 1027->1021 1042 40eadb-40eb00 call 40f112 1031->1042 1043 40eacf-40ead8 1031->1043 1040->1041 1041->972 1046 40eb02-40eb07 1042->1046 1047 40eb43-40eb46 1042->1047 1043->1042 1050 40eb09-40eb0b 1046->1050 1051 40eb0f-40eb14 1046->1051 1048 40eb4c-40eba9 call 40e763 call 40e611 call 40e008 1047->1048 1049 40ecae-40ecb3 1047->1049 1065 40ebae-40ebb3 1048->1065 1055 40ecb5-40ecb6 1049->1055 1056 40ecbb-40ecdf 1049->1056 1050->1051 1053 40eb16-40eb18 1051->1053 1054 40eb1c-40eb34 call 40e690 call 40e585 1051->1054 1053->1054 1066 40eb36-40eb38 1054->1066 1067 40eb3c-40eb3e 1054->1067 1055->1056 1056->972 1056->1014 1068 40ec15-40ec1b 1065->1068 1069 40ebb5 1065->1069 1066->1067 1067->972 1070 40ec21-40ec23 1068->1070 1071 40ec1d-40ec1f 1068->1071 1072 40ebb7 1069->1072 1073 40ebc5-40ebc7 1070->1073 1074 40ec25-40ec31 1070->1074 1071->1072 1075 40ebba-40ebc3 call 40f0bf 1072->1075 1079 40ebc9-40ebca 1073->1079 1080 40ebcf-40ebd1 1073->1080 1076 40ec33-40ec35 1074->1076 1077 40ec37-40ec3d 1074->1077 1075->1073 1086 40ec02-40ec04 1075->1086 1076->1075 1077->1056 1083 40ec3f-40ec45 1077->1083 1079->1080 1081 40ebd3-40ebd5 1080->1081 1082 40ebd9-40ebf1 call 40e690 call 40e585 1080->1082 1081->1082 1082->1000 1093 40ebf7-40ebfd 1082->1093 1083->1056 1089 40ec06-40ec08 1086->1089 1090 40ec0c-40ec10 1086->1090 1089->1090 1090->1056 1093->1000
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _EH_prolog.MSVCRT ref: 0040E830
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 0040E9CE
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000038,00000000,00000001), ref: 0040EAA1
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040ED7F: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,0040EAB2,00000000,00000001), ref: 0040EDA7
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@$H_prolog
                                                                                                                                                                                                                                                                                              • String ID: <]A
                                                                                                                                                                                                                                                                                              • API String ID: 3431946709-3707672569
                                                                                                                                                                                                                                                                                              • Opcode ID: 04cf34d8ff487bea99b6e38d770e7741b1dc371dfc0d2de79d58089e98610788
                                                                                                                                                                                                                                                                                              • Instruction ID: fb09e060f7b5ded2eb6e5006c13314ba223be2c96fd0a2c6114c4de45a1c8ed0
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 04cf34d8ff487bea99b6e38d770e7741b1dc371dfc0d2de79d58089e98610788
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 00F14970600208DFDB24DF6AC884AAA77E5BF48314F14496AFC16AB292DB39ED51CF54
                                                                                                                                                                                                                                                                                              Function 00404932 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1096 404932-4049b3 #17 call 412910 call 40215d call 4021b3 * 7 1115 4049b8-4049cc SHGetSpecialFolderPathW 1096->1115 1116 404a61-404a65 1115->1116 1117 4049d2-404a1c wsprintfW call 401484 * 2 call 40139c * 2 call 403305 1115->1117 1116->1115 1119 404a6b-404a6f 1116->1119 1128 404a21-404a27 1117->1128 1129 404a51-404a57 1128->1129 1130 404a29-404a4c call 40139c * 2 call 403305 1128->1130 1129->1128 1132 404a59-404a5c call 4026c6 1129->1132 1130->1129 1132->1116
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • #17.COMCTL32(00000000,00000020,-00000002), ref: 0040493E
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040215D: GetUserDefaultUILanguage.KERNEL32(0040494E), ref: 00402167
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 00402202
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: wsprintfW.USER32 ref: 00402213
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402228
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetLastError.KERNEL32 ref: 0040222D
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402248
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040225B
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetLastError.KERNEL32 ref: 00402262
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: lstrcmpiW.KERNEL32(00000000,00404955), ref: 00402277
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402287
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: SetLastError.KERNEL32(?), ref: 004022AE
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: lstrlenA.KERNEL32(00415208), ref: 004022E2
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022FD
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 0040232F
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: ??3@YAXPAX@Z.MSVCRT(00404955), ref: 004022A5
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: _wtol.MSVCRT ref: 00402340
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: MultiByteToWideChar.KERNEL32(00000000,00415208,00000001,00000000,00000002), ref: 00402360
                                                                                                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000), ref: 004049C4
                                                                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 004049DF
                                                                                                                                                                                                                                                                                                • Part of subcall function 00403305: ??2@YAPAXI@Z.MSVCRT(00000018,00000000,00404A21,?,?,?), ref: 0040330A
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
                                                                                                                                                                                                                                                                                              • String ID: 7zSfxFolder%02d
                                                                                                                                                                                                                                                                                              • API String ID: 3387708999-2820892521
                                                                                                                                                                                                                                                                                              • Opcode ID: f726563fb2b2250325101bcf8807e48b976bb1d9adb6114e41abcfa48ef34141
                                                                                                                                                                                                                                                                                              • Instruction ID: ef9653e53972978df07657c60cee51bcb8c88d210e083c37f24b76d073d3d503
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f726563fb2b2250325101bcf8807e48b976bb1d9adb6114e41abcfa48ef34141
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 38316371D002099BDB01FBA1ED8AADE7B78AB40304F14407FA619B61E1EFB956448B58
                                                                                                                                                                                                                                                                                              Function 00402C1A Relevance: 6.4, APIs: 5, Instructions: 118stringCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1138 402c1a-402c64 call 412c00 call 40c5fe lstrlenA * 2 1142 402c69-402c85 call 40c5ca 1138->1142 1144 402d55 1142->1144 1145 402c8b-402c90 1142->1145 1146 402d57-402d5b 1144->1146 1145->1144 1147 402c96-402ca0 1145->1147 1148 402ca3-402ca8 1147->1148 1149 402ce7-402cec 1148->1149 1150 402caa-402caf 1148->1150 1151 402d11-402d35 memmove 1149->1151 1152 402cee-402d01 memcmp 1149->1152 1150->1151 1153 402cb1-402cc4 memcmp 1150->1153 1158 402d44-402d4f 1151->1158 1159 402d37-402d3e 1151->1159 1156 402ce1-402ce5 1152->1156 1157 402d03-402d0f 1152->1157 1154 402d51-402d53 1153->1154 1155 402cca-402cd4 1153->1155 1154->1146 1155->1144 1160 402cd6-402cdc call 402957 1155->1160 1156->1148 1157->1148 1158->1146 1159->1158 1161 402c66 1159->1161 1160->1156 1161->1142
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00403D3A,00418818,?,?,00405C4E,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402C4C
                                                                                                                                                                                                                                                                                              • lstrlenA.KERNEL32(?,?,00403D3A,00418818,?,?,00405C4E,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402C54
                                                                                                                                                                                                                                                                                              • memcmp.MSVCRT(00000000,?,?), ref: 00402CBA
                                                                                                                                                                                                                                                                                              • memcmp.MSVCRT(00000000,?,?,?,00403D3A,00418818,?,?,00405C4E,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402CF7
                                                                                                                                                                                                                                                                                              • memmove.MSVCRT(?,?,00000000,?,00403D3A,00418818,?,?,00405C4E,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402D29
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: lstrlenmemcmp$memmove
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3251180759-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a05ed66240b8c48cd1d6013260c459d9ae8ab5bba4ea14475bffcaa69264c57e
                                                                                                                                                                                                                                                                                              • Instruction ID: b3b94cb524035ad5456d55853ae81138a361194cb35f605d71d704438a574b18
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a05ed66240b8c48cd1d6013260c459d9ae8ab5bba4ea14475bffcaa69264c57e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4A417E72D0425AAFDF01DFA4C9889EEBBB9FF08344F14406AE805B3291D3B49E55CB55
                                                                                                                                                                                                                                                                                              Function 0040163D Relevance: 6.1, APIs: 4, Instructions: 100synchronizationthreadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1165 40163d-401693 call 40114b call 40139c call 401552 CreateThread 1172 401695 call 408532 1165->1172 1173 40169a-4016b5 WaitForSingleObject 1165->1173 1172->1173 1175 4016b7-4016ba 1173->1175 1176 4016e9-4016ef 1173->1176 1177 4016bc-4016bf 1175->1177 1178 4016dd 1175->1178 1179 4016f1-401706 GetExitCodeThread 1176->1179 1180 40174d 1176->1180 1183 4016c1-4016c4 1177->1183 1184 4016d9-4016db 1177->1184 1185 4016df-4016e7 call 408dd2 1178->1185 1181 401710-40171b 1179->1181 1182 401708-40170a 1179->1182 1186 401752-401755 1180->1186 1188 401723-40172c 1181->1188 1189 40171d-40171e 1181->1189 1182->1181 1187 40170c-40170e 1182->1187 1190 4016d5-4016d7 1183->1190 1191 4016c6-4016c9 1183->1191 1184->1185 1185->1180 1187->1186 1194 401737-401743 SetLastError 1188->1194 1195 40172e-401735 1188->1195 1193 401720-401721 1189->1193 1190->1185 1196 4016d0-4016d3 1191->1196 1197 4016cb-4016ce 1191->1197 1199 401745-40174a call 408dd2 1193->1199 1194->1199 1195->1180 1195->1194 1196->1193 1197->1180 1197->1196 1199->1180
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateThread.KERNELBASE(00000000,00000000,0040130F,00000000,00000000,?), ref: 00401681
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(000000FF,?,00401821,?,?), ref: 004016A2
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: wvsprintfW.USER32(?,00000000,?), ref: 00408DF6
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: GetLastError.KERNEL32 ref: 00408E07
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,00406BA8), ref: 00408E2F
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00406BA8), ref: 00408E44
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: lstrlenW.KERNEL32(?), ref: 00408E57
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: lstrlenW.KERNEL32(?), ref: 00408E5E
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00408E73
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: lstrcpyW.KERNEL32(00000000,?), ref: 00408E89
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: lstrcpyW.KERNEL32(-00000002,?), ref: 00408E9A
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 00408EA3
                                                                                                                                                                                                                                                                                                • Part of subcall function 00408DD2: LocalFree.KERNEL32(?), ref: 00408EAD
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 359084233-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 5784c911f70ec8615644968fb8a473c4f5c63dc6ffda89886972cfc35f3b4edb
                                                                                                                                                                                                                                                                                              • Instruction ID: 7d3ff62e437ea0c91cf1abde2eedf7a668452c74c486bf28c73a25e4bfcfdf4b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5784c911f70ec8615644968fb8a473c4f5c63dc6ffda89886972cfc35f3b4edb
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E31D171600200BBEB316B15DC49AAB36A9EB95750F34853FF416B62F0DA798881DB1D
                                                                                                                                                                                                                                                                                              Function 00401BA1 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1202 401ba1-401bb0 CreateDirectoryW 1203 401be2-401be6 1202->1203 1204 401bb2-401bbf GetLastError 1202->1204 1205 401bc1 1204->1205 1206 401bcc-401bd9 GetFileAttributesW 1204->1206 1207 401bc2-401bcb SetLastError 1205->1207 1206->1203 1208 401bdb-401bdd 1206->1208 1208->1203 1209 401bdf-401be0 1208->1209 1209->1207
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(00403797,00000000,-00000001,00403797,?,004017FB,?,?,?,?,004017FB,?), ref: 00401BA8
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,004017FB,?), ref: 00401BB2
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(000000B7,?,?,?,?,004017FB,?), ref: 00401BC2
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017FB,?), ref: 00401BD0
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$AttributesCreateDirectoryFile
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 635176117-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 8f2a3c8d3dbd0b9b157f311614eca2aec544d8a8cefd4afcfa6ece4cce76612a
                                                                                                                                                                                                                                                                                              • Instruction ID: f7db12ecad7dba541322b8e170da9c659b9c03f701e9f85f77f9de7f49b8af7a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f2a3c8d3dbd0b9b157f311614eca2aec544d8a8cefd4afcfa6ece4cce76612a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EFE012305581106BDB101FB4FC4CB9B7EA9AB95325F608975F469E41F4E3349C814559
                                                                                                                                                                                                                                                                                              Function 00403CBF Relevance: 4.7, APIs: 3, Instructions: 151COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1210 403cbf-403cd1 call 40239b 1213 403cd3-403cd6 1210->1213 1214 403ced-403cf4 1210->1214 1215 403cd8-403cdb 1213->1215 1216 403cdd-403ceb 1213->1216 1217 403cfb 1214->1217 1218 403cfe-403d3f call 40284f * 3 call 403bce call 402c1a 1215->1218 1216->1217 1217->1218 1229 403d41 1218->1229 1230 403d45-403d59 call 40291f 1218->1230 1229->1230 1233 403da8-403daa 1230->1233 1234 403d5b-403d77 call 403bce call 402c1a 1233->1234 1235 403dac-403dd9 call 403bce call 402c1a 1233->1235 1242 403d7c-403d81 1234->1242 1244 403ddb 1235->1244 1245 403ddf-403df0 call 4029b5 1235->1245 1246 403da3-403da6 1242->1246 1247 403d83-403d86 1242->1247 1244->1245 1254 403e46-403e48 1245->1254 1246->1233 1249 403d94-403d9f call 4029b5 1247->1249 1250 403d88-403d8f call 40297f 1247->1250 1249->1246 1250->1249 1256 403df2-403e15 call 403bce call 402c1a 1254->1256 1257 403e4a-403e6c ??3@YAXPAX@Z * 3 1254->1257 1261 403e1a-403e1f 1256->1261 1262 403e41-403e44 1261->1262 1263 403e21-403e24 1261->1263 1262->1254 1264 403e32-403e3d call 4029b5 1263->1264 1265 403e26-403e2d call 40297f 1263->1265 1264->1262 1265->1264
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040239B: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,004023D1,00405BCF,00418818,00418818), ref: 004023AB
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040239B: GetProcAddress.KERNEL32(00000000), ref: 004023B2
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040239B: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,004023D1,00405BCF,00418818,00418818), ref: 004023C0
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00405C4E,?,?,?,?,?,?,?,00405C4E), ref: 00403E4D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00405C4E,?,?,?,?,?,?,?,00405C4E), ref: 00403E55
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00405C4E,?,?,?,?,?,?,?,00405C4E), ref: 00403E5D
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1642057587-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 6042af1b324c03e55860d3893d722feea57423bea14313fcf9d4a7c2317be7d3
                                                                                                                                                                                                                                                                                              • Instruction ID: 4cbf597906b98135771b168b77b6eb183d18575d7e5ac8660be24c748504df3f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6042af1b324c03e55860d3893d722feea57423bea14313fcf9d4a7c2317be7d3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8A515EB2D00109ABDF01EFD1C9859FEBB7EAF58309F04402AF511B2191EB7D9A46DB54
                                                                                                                                                                                                                                                                                              Function 00401758 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 103COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1269 401758-40176f ??2@YAPAXI@Z 1270 401771-401778 call 40fb56 1269->1270 1271 40177a 1269->1271 1272 40177c-4017a8 call 401132 call 40c5fe 1270->1272 1271->1272 1279 4017c0-4017c9 call 408dd2 1272->1279 1280 4017aa-4017be call 40110a 1272->1280 1286 4017ca-4017cf 1279->1286 1280->1279 1285 4017e8-4017f2 1280->1285 1289 401800-40180a ??2@YAPAXI@Z 1285->1289 1290 4017f4-4017f6 call 40371d 1285->1290 1287 4017d1-4017d3 1286->1287 1288 4017d7-4017d9 1286->1288 1287->1288 1291 4017e1-4017e6 1288->1291 1292 4017db-4017dd 1288->1292 1294 401815 1289->1294 1295 40180c-401813 call 40149c 1289->1295 1297 4017fb-4017fe 1290->1297 1296 40183c-401840 1291->1296 1292->1291 1299 401817-40181c call 40163d 1294->1299 1295->1299 1297->1286 1297->1289 1302 401821-401828 1299->1302 1303 401830-401832 1302->1303 1304 40182a-40182c 1302->1304 1305 401834-401836 1303->1305 1306 40183a 1303->1306 1304->1303 1305->1306 1306->1296
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(000001E8,00000000,004187D0,ExecuteFile,0000006A,0000006A,?,00406645,?,004187D0,004187D0), ref: 00401765
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000040), ref: 00401802
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040371D: lstrlenW.KERNEL32(004017FB,00000000,?,?,?,?,?,?,004017FB,?), ref: 0040372A
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040371D: GetSystemTimeAsFileTime.KERNEL32(?,004017FB,?,?,?,?,004017FB,?), ref: 004037A0
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040371D: GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017FB,?), ref: 004037A7
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040371D: ??3@YAXPAX@Z.MSVCRT(?,004017FB,?,?,?,?,004017FB,?), ref: 00403866
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@FileTime$??3@AttributesSystemlstrlen
                                                                                                                                                                                                                                                                                              • String ID: ExecuteFile
                                                                                                                                                                                                                                                                                              • API String ID: 1306139538-323923146
                                                                                                                                                                                                                                                                                              • Opcode ID: 5728c1b83bc4d1b9980e370ae573a7b0c9e39e3a3f34e0a4038bcb615272f731
                                                                                                                                                                                                                                                                                              • Instruction ID: 696917977cc0af5d7a86523ea3cefee026201a0d6e9a1adebbd371a6d4f8659a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5728c1b83bc4d1b9980e370ae573a7b0c9e39e3a3f34e0a4038bcb615272f731
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8B31C575700204ABDB24ABA5CC85D6F77A9EF84705728447FF401FB2A1DA39AD41CB28
                                                                                                                                                                                                                                                                                              Function 0040D5B6 Relevance: 4.5, APIs: 3, Instructions: 35COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1308 40d5b6-40d5c1 1309 40d600-40d602 1308->1309 1310 40d5c3-40d5c6 1308->1310 1311 40d5c8-40d5d6 ??2@YAPAXI@Z 1310->1311 1312 40d5ee 1310->1312 1313 40d5f0-40d5ff ??3@YAXPAX@Z 1311->1313 1314 40d5d8-40d5da 1311->1314 1312->1313 1313->1309 1315 40d5dc 1314->1315 1316 40d5de-40d5ec memmove 1314->1316 1315->1316 1316->1313
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(?,?,?,?,004102C5,00010000), ref: 0040D5C9
                                                                                                                                                                                                                                                                                              • memmove.MSVCRT(00000000,?,?,?,?,?,004102C5,00010000), ref: 0040D5E3
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,004102C5,00010000), ref: 0040D5F3
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@??3@memmove
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3828600508-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 67b98665b8dcbfdd3e4d109b89c80be00f36e07207969b21e35def3519e69f6f
                                                                                                                                                                                                                                                                                              • Instruction ID: d5dacd1b3fb98c21124dc1d33f48c6efd6003bf6c14ff8fbee7813475d9ee9aa
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67b98665b8dcbfdd3e4d109b89c80be00f36e07207969b21e35def3519e69f6f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47F0E232B042006FC2305F6A9E8095BBBE9EBC4718314883FF95ED6351D634F8848628
                                                                                                                                                                                                                                                                                              Function 0040E008 Relevance: 4.2, APIs: 3, Instructions: 462COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000018,00000000,?,00000000,?), ref: 0040E073
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000028,00000000,00000000,?,00000000,?), ref: 0040E0BD
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1033339047-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 681626a6d2388e1b46a499882a508d01bee9b587e2816172e644e9a69fa16b25
                                                                                                                                                                                                                                                                                              • Instruction ID: 786736d933f003369f23863796d1619ed635801a4e32b20000a897f24b9a5b67
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 681626a6d2388e1b46a499882a508d01bee9b587e2816172e644e9a69fa16b25
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1121771A00209DFCB14DFA6C8908A9BBB5FF48304B14497EF91AA7391DB39ED55CB44
                                                                                                                                                                                                                                                                                              Function 004026FB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040271F
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: GlobalMemoryStatus
                                                                                                                                                                                                                                                                                              • String ID: @
                                                                                                                                                                                                                                                                                              • API String ID: 1890195054-2766056989
                                                                                                                                                                                                                                                                                              • Opcode ID: 10a1a0dca67190ae1b2f8bab539977c25a6fc9f7f1c138144fabb0a44fa63ec7
                                                                                                                                                                                                                                                                                              • Instruction ID: c3a6faa0462241a280be2d9353c1e47863c81d4e618bf62eab88ba7ec8474a40
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 10a1a0dca67190ae1b2f8bab539977c25a6fc9f7f1c138144fabb0a44fa63ec7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1DF0AF306042088ACF15AB70DF4DA5A76A5BB00308F10463AE012F71D0DBF89981864C
                                                                                                                                                                                                                                                                                              Function 00411AF9 Relevance: 3.2, APIs: 2, Instructions: 200COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040FBFC: _CxxThrowException.MSVCRT(?,00416250), ref: 0040FC16
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00415DDC,?,00415D94), ref: 00411C17
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00415DDC,?,00415D94), ref: 00411D6F
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$ExceptionThrow
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2803161813-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b993efc40368fd69e6ac657a65e76f6bc64138533e57705c6864ce29429bcb79
                                                                                                                                                                                                                                                                                              • Instruction ID: a4732db55583ca78181ff33f67714ccec4ec82aa11d2dee84a4e715c00db3ea7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b993efc40368fd69e6ac657a65e76f6bc64138533e57705c6864ce29429bcb79
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CE814E70A04609ABCB24DFA5C991AEEF7B1BF08304F10452FE615A7761E738B984CB58
                                                                                                                                                                                                                                                                                              Function 0040F78D Relevance: 3.1, APIs: 2, Instructions: 135COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@H_prolog
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1329742358-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 324c3a7cbfe9bcc9a0093a6b1fc01d4b03cfa3ecc6e1453f09a11163b89f0df4
                                                                                                                                                                                                                                                                                              • Instruction ID: efb2f00d33aa1ccf63bb6429db99bdc6da243e5c394d73c928979b154fe646cf
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 324c3a7cbfe9bcc9a0093a6b1fc01d4b03cfa3ecc6e1453f09a11163b89f0df4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5B41C573800109AFCB25EBA5C945AEE7775EF05304B19813BE80177AE2D73C5E0D9A59
                                                                                                                                                                                                                                                                                              Function 0040119E Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011BE
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011E4
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@??3@
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1936579350-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c2f5fa9c0539de2c4a7f53d681735384437a504ee41f3ab63c15851ff9d6caec
                                                                                                                                                                                                                                                                                              • Instruction ID: fbffce2cb9c5a4c22f50dad7d41ebaab4f040ab4d9ad274b237e9742f84e4579
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c2f5fa9c0539de2c4a7f53d681735384437a504ee41f3ab63c15851ff9d6caec
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 41F0A436210611ABC334DF6DC591867B3E4FF88355720883FE6D6CB6A1DA71B890C754
                                                                                                                                                                                                                                                                                              Function 0040BEB6 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040BED1
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?), ref: 0040BEDF
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2976181284-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2dc8cee5598d33c9ccf099f17d10e976f116823a694517a44c1af7d0a77e4e36
                                                                                                                                                                                                                                                                                              • Instruction ID: 58a5dddce790eb067e59aca2af7185a8748fd17e24e05fc10a277d90b8df01f0
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2dc8cee5598d33c9ccf099f17d10e976f116823a694517a44c1af7d0a77e4e36
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0DF0B7B5900208EFCB04CF95D8548EE7BB5EB89310B10C569F925A7390D7359A50DBA8
                                                                                                                                                                                                                                                                                              Function 0040C169 Relevance: 3.0, APIs: 2, Instructions: 24memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SysAllocString.OLEAUT32(?), ref: 0040C181
                                                                                                                                                                                                                                                                                              • _CxxThrowException.MSVCRT(?,00415F74), ref: 0040C1A4
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AllocExceptionStringThrow
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3773818493-0
                                                                                                                                                                                                                                                                                              • Opcode ID: fb0b8424ea3c18422dfb4546465b5c411461c7c894348be57eca799396026cd2
                                                                                                                                                                                                                                                                                              • Instruction ID: 9d709aa8e1cfb26431d9c10f6fda3bd1f7118755983c1d1d8d4145ebeb66b084
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fb0b8424ea3c18422dfb4546465b5c411461c7c894348be57eca799396026cd2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2EE06D31100308EBDB10AFA5D8819C67BE8EF04380B00C63FF908CA251E678D580CBD8
                                                                                                                                                                                                                                                                                              Function 00401521 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 613200358-0
                                                                                                                                                                                                                                                                                              • Opcode ID: ec12ff30771228872eb63ce016cb1097791755a5c5cf41ef4c244471a93fb349
                                                                                                                                                                                                                                                                                              • Instruction ID: 5742f67201d23beaa9f8636bee72048afea15845169d910c3e0dc09cacb252b0
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec12ff30771228872eb63ce016cb1097791755a5c5cf41ef4c244471a93fb349
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 14E086325015149FC720AF55E814DC7B3E4EF44315315856EF48ADB660CB78FC82CB84
                                                                                                                                                                                                                                                                                              Function 0040CFDF Relevance: 2.5, APIs: 2, Instructions: 34COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0040CFEA
                                                                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 0040D009
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3168844106-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 9e5b06dc87699637085a0abfbb9de17ca0a3ebb0801bf684ed8affee5a97ca5d
                                                                                                                                                                                                                                                                                              • Instruction ID: f5706fc576ce77f3a24d7962246a0e1372d4318d431a8e20e1a1b6a23e370181
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e5b06dc87699637085a0abfbb9de17ca0a3ebb0801bf684ed8affee5a97ca5d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 83F03036600214EBCB218F95DC08E9ABBB9EF8D760F10442AFA55A7261C771E811DBA4
                                                                                                                                                                                                                                                                                              Function 0040F93C Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b310e02a71b0e9b0f57c8ff350f317a12e9997ed6537326e98dc413991563931
                                                                                                                                                                                                                                                                                              • Instruction ID: 6846990a0b7c700b0e564570ba35e58a51d6e24bd287ea03595f4ec4833d5ae3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b310e02a71b0e9b0f57c8ff350f317a12e9997ed6537326e98dc413991563931
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2521B530700209ABCB24EFA5D855BAE7774AF40308F10443EF41ABB691DB38ED09CB69
                                                                                                                                                                                                                                                                                              Function 0040DF18 Relevance: 1.5, APIs: 1, Instructions: 38COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 0040DF4D
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 613200358-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 75b8e81de9118c2183978d3f94624743d261298bfa92fcf7a68175402f56a01a
                                                                                                                                                                                                                                                                                              • Instruction ID: 7840a2ccd5a960e93a6d95847f56d5fff308d56e59930d1c0d757fa52b2cbb73
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75b8e81de9118c2183978d3f94624743d261298bfa92fcf7a68175402f56a01a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2BF09072A1010CBBDB11AF59C8818AEB3ACEF81364700803BFD09AB341D679ED0587A4
                                                                                                                                                                                                                                                                                              Function 0040127E Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetFileAttributesW.KERNELBASE(?,?), ref: 004012C2
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AttributesFile
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3188754299-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 99bbeda3998a939772efb656e1c99ec3b49f936e01c00e27716b5450bac36e45
                                                                                                                                                                                                                                                                                              • Instruction ID: 8804b63aef8d5166b786aa1d470143da4cafa9e74bcb3062b324a687b6a94c0e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99bbeda3998a939772efb656e1c99ec3b49f936e01c00e27716b5450bac36e45
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1FF05832100602EFD720ABA9D840AA7B7F5BB94311F04892EE586F26E0D738A885CB55
                                                                                                                                                                                                                                                                                              Function 0040BF1C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040BE4B: CloseHandle.KERNELBASE(00418818,?,0040BF27,00000000,?,0040BF6F,00405C0F,80000000,?,?,?,0040BF91,?,00418818,00000003,00000080), ref: 0040BE56
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE(00418818,00000000,?,00000000,00405C0F,00000000,00000000,00000000,?,0040BF6F,00405C0F,80000000,?,?,?,0040BF91), ref: 0040BF3E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseCreateFileHandle
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3498533004-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 8d75af9a6c217c950491c3631b52d086b6a135f3c5a9e976b3a65ef09916f851
                                                                                                                                                                                                                                                                                              • Instruction ID: 90411d92f9d8fc56c138e00aa788ce8dd8e9066487309eaec17cc9a92b37b09c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8d75af9a6c217c950491c3631b52d086b6a135f3c5a9e976b3a65ef09916f851
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0EE04F360002196BCF215F649C01BCA3B95AF09360F104126BB24A61E0C772D465AB9C
                                                                                                                                                                                                                                                                                              Function 0040C05D Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,0040C67B,00000001,00418818,00418818,0041449C,?,004055C8,?,?), ref: 0040C080
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileWrite
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3934441357-0
                                                                                                                                                                                                                                                                                              • Opcode ID: f87172bd460ca3b54a79ebd290cb322ba78c3867cc27832738d70ce0c19e6544
                                                                                                                                                                                                                                                                                              • Instruction ID: b8ac05db2d4a94fa31fca8da97501392d380f31373f02cc2359ce7771c6d952e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f87172bd460ca3b54a79ebd290cb322ba78c3867cc27832738d70ce0c19e6544
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5BE03234640208FFCB00CFA0C800B8E3BB9AB08714F20C028F8189A2A0C3399A10EF14
                                                                                                                                                                                                                                                                                              Function 00406E34 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _beginthreadex
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3014514943-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b45036c3ba1d8840ed147fa51aa3b54808154657542cc12759115a57a724e90e
                                                                                                                                                                                                                                                                                              • Instruction ID: 247003c3cbeddfb2b625e3bdb8727c8b4f2641553652fddb98de5e4cb0adc6ee
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b45036c3ba1d8840ed147fa51aa3b54808154657542cc12759115a57a724e90e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4AD05EF6900208BFCF01EFE0CC05CEB3BADEF08244B008464BD05C2110E672DA109BB0
                                                                                                                                                                                                                                                                                              Function 00411D7E Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: H_prolog
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 79dd5a53ceaa10d323906d6c4c09a067708a8351cba9fff8f600675c26666cc2
                                                                                                                                                                                                                                                                                              • Instruction ID: 72e6a8a8c5ad423b706d1c8477e98d2bf6fe7c2d1236b40809de9acfe940e46e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 79dd5a53ceaa10d323906d6c4c09a067708a8351cba9fff8f600675c26666cc2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54D05B72A00114ABD7159F85DD05BDEFB78EF81359F10816FF10151110D3BD6A41856D
                                                                                                                                                                                                                                                                                              Function 0040BFA2 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 0040BFB8
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileRead
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2738559852-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e9757d328d643c7454ad56557c4d9905e5ed03d7027cc49797d163fdbd19fd89
                                                                                                                                                                                                                                                                                              • Instruction ID: 6600978e9b0ccbf498a810640cc831596d613c388fbe18220f7993c6c269e9fc
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e9757d328d643c7454ad56557c4d9905e5ed03d7027cc49797d163fdbd19fd89
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FFE0EC75200208FFDB01CF91CD01FDE7BBEEB49754F208068EA0596160C7759A10EB54
                                                                                                                                                                                                                                                                                              Function 0040C030 Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetFileTime.KERNELBASE(?,?,?,?,0040C05A,00000000,00000000,?,004012AF,?), ref: 0040C03E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileTime
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1425588814-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c0e5e33048760219d2a04593f2bb40d099f123eabf13ff9ad38c69bb38ccd200
                                                                                                                                                                                                                                                                                              • Instruction ID: ea010d3a690561246fe19a690d3fd65df6325dae63f8daef288d6a2187e6b862
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c0e5e33048760219d2a04593f2bb40d099f123eabf13ff9ad38c69bb38ccd200
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AEC04C3A158105FFCF020FB0CC04C1ABFA2AB99311F10C918B259C5070C7328024EB02
                                                                                                                                                                                                                                                                                              Function 0040D0F9 Relevance: 1.3, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • memmove.MSVCRT(?,?,00000001,?,?,?,?,?,?,0040D196,?,004099CD), ref: 0040D126
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: memmove
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2162964266-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 629220965c6bd2db472e7962868e1e1f545117e5f950cd86d21845d398ffb971
                                                                                                                                                                                                                                                                                              • Instruction ID: a4b432defa2f872f2e946a78cf9859ae6dceab650c9b954c79c80a890c02e361
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 629220965c6bd2db472e7962868e1e1f545117e5f950cd86d21845d398ffb971
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3B21E471A00B009FC720CF9AC88485BF7FAFF88724764892EE09A97A50E774BD45CB54
                                                                                                                                                                                                                                                                                              Function 0040CED6 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _CxxThrowException.MSVCRT(?,00415FFC), ref: 0040CF19
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExceptionThrow
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 432778473-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c55205c91926b37fafed77e2ec1812a0d6aea0a5967d0921fad9188accd9e898
                                                                                                                                                                                                                                                                                              • Instruction ID: 6a5d6d8d1e5a2607387ff05ecddc3380d06d5443c211f61aaf30d4f4d0e37a27
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c55205c91926b37fafed77e2ec1812a0d6aea0a5967d0921fad9188accd9e898
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EB017171501701EFDB28CF69C845A9BBBF8EF453107144A6EA482D3641D374FA46CB90
                                                                                                                                                                                                                                                                                              Function 00403305 Relevance: 1.3, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000018,00000000,00404A21,?,?,?), ref: 0040330A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1033339047-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7e063798c2ce49969361d9b7fe6375fdb1e7f17d00aa3dc22709233837362719
                                                                                                                                                                                                                                                                                              • Instruction ID: 9ef6f0e2e02f5eae2298eed2354599e037224ec6dfed32698a6da5f5f3818d78
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7e063798c2ce49969361d9b7fe6375fdb1e7f17d00aa3dc22709233837362719
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E4D0A93570821016DA94A9720E42ABF09888F80361B00083FBC01F72C0EC7C8941429D
                                                                                                                                                                                                                                                                                              Function 0040BE4B Relevance: 1.3, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00418818,?,0040BF27,00000000,?,0040BF6F,00405C0F,80000000,?,?,?,0040BF91,?,00418818,00000003,00000080), ref: 0040BE56
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseHandle
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2962429428-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d75d5fc0baf4f2939d0adfdd415025799ab6c32361fdd26dbcb1c09c5b554eea
                                                                                                                                                                                                                                                                                              • Instruction ID: be21f2d7e2f065a1e4cf32b2320b5ecc72b3a54c58d665c0bd3e5472e34ca940
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d75d5fc0baf4f2939d0adfdd415025799ab6c32361fdd26dbcb1c09c5b554eea
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9D0123160422146CE741E3CB8445D337D89E46374321476BF5B5E32F0D3748C8346D8
                                                                                                                                                                                                                                                                                              Function 00402765 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,0040CEBC,?,?,?,004096CF,?), ref: 00402781
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AllocVirtual
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c0747d2b54f00527e28e55407353a72f8354565475e3e521c76b3ccfb0f995d3
                                                                                                                                                                                                                                                                                              • Instruction ID: c8419c84987ab9f9043192ec71a1da35683a063982673f1d4b03f9dfb55d97bf
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c0747d2b54f00527e28e55407353a72f8354565475e3e521c76b3ccfb0f995d3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DAC08C302483007AEE1517A08F0BF4A3662AB88B1AF40C429F384A50E0D7F58400B60D
                                                                                                                                                                                                                                                                                              Function 0040BE30 Relevance: 1.3, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(000000C8), ref: 0040BE35
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1033339047-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2a87814b8ee0f974914201996678344eb87e61b6115ffd530b7294b2753e6683
                                                                                                                                                                                                                                                                                              • Instruction ID: 8284bdf7f0616f972821d8d64faf27d026dd822893dac6d2f7a747445fc68b62
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a87814b8ee0f974914201996678344eb87e61b6115ffd530b7294b2753e6683
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9BB0128170910101FAC025311E1376B00C0CBC5385F4409375A03FD2C2FF6CD41452EF
                                                                                                                                                                                                                                                                                              Function 00401D26 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • VirtualFree.KERNELBASE(?,00000000,00008000,0040CE64,00000000,?,0040CEB3,?,?,004096CF,?), ref: 00401D38
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FreeVirtual
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 32a91dde98d5100741efe9c4c504ac7ef1165072957eb49c26da89f99dbc19d7
                                                                                                                                                                                                                                                                                              • Instruction ID: 52e13e518f9be9114dfd9f0dcb33d46b5f51ce713fe3f05cd2c94b9e5c1fb23c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 32a91dde98d5100741efe9c4c504ac7ef1165072957eb49c26da89f99dbc19d7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6DB09230244300BEEF214B00DE0DB4A77A1AB90B01F20C928B198241F097B86844DA09

                                                                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                                                                              Function 0040388A Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 290comCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 004038AE
                                                                                                                                                                                                                                                                                              • SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000,004187E8,00000000,004187DC), ref: 00403951
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 004039C2
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 004039CA
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004039D2
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 004039DA
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 004039E2
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 004039EA
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 004039F2
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 00403A48
                                                                                                                                                                                                                                                                                              • CoCreateInstance.OLE32(00415E24,00000000,00000001,00415DE4,AW@,.lnk,?,0000005C), ref: 00403AE9
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 00403B81
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 00403B89
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 00403B91
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 00403B99
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 00403BA1
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 00403BA9
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 00403BB1
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 00403BB7
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 00403BBF
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
                                                                                                                                                                                                                                                                                              • String ID: .lnk$AW@
                                                                                                                                                                                                                                                                                              • API String ID: 408529070-3304780919
                                                                                                                                                                                                                                                                                              • Opcode ID: 13acbc408fa38cf7e1fa9728c313aa15981d0af7475c6c636a0f1c4c12615c03
                                                                                                                                                                                                                                                                                              • Instruction ID: ac1975162933dc708b18ff6028a348059c12a5eb5a94371c916586bd2bb8d11a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 13acbc408fa38cf7e1fa9728c313aa15981d0af7475c6c636a0f1c4c12615c03
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64A18F75810209ABDF14EFA1CD46DEEBB78FF54309F50442EF412B61A1DB78AA85CB18
                                                                                                                                                                                                                                                                                              Function 004021B3 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 00402202
                                                                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00402213
                                                                                                                                                                                                                                                                                              • GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402228
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0040222D
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402248
                                                                                                                                                                                                                                                                                              • GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040225B
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00402262
                                                                                                                                                                                                                                                                                              • lstrcmpiW.KERNEL32(00000000,00404955), ref: 00402277
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402287
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00404955), ref: 004022A5
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?), ref: 004022AE
                                                                                                                                                                                                                                                                                              • lstrlenA.KERNEL32(00415208), ref: 004022E2
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022FD
                                                                                                                                                                                                                                                                                              • GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 0040232F
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 00402340
                                                                                                                                                                                                                                                                                              • MultiByteToWideChar.KERNEL32(00000000,00415208,00000001,00000000,00000002), ref: 00402360
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
                                                                                                                                                                                                                                                                                              • String ID: 7zSfxString%d
                                                                                                                                                                                                                                                                                              • API String ID: 2117570002-3906403175
                                                                                                                                                                                                                                                                                              • Opcode ID: c19d51b0fb4e363887bc9bf560425d9ef72edad3e209db1ef76b32328730d99c
                                                                                                                                                                                                                                                                                              • Instruction ID: 3ab846e255d67cb18ffe3ad7b55f1665823b4c0101406b52f8400e9fffcfb60b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c19d51b0fb4e363887bc9bf560425d9ef72edad3e209db1ef76b32328730d99c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B951D571A00208EFCB109FB4DD49ADA7BB8FB49300B11447FE506E72D0DB78A994CB28
                                                                                                                                                                                                                                                                                              Function 00401DF5 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 00401E00
                                                                                                                                                                                                                                                                                              • FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401E1D
                                                                                                                                                                                                                                                                                              • FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401E31
                                                                                                                                                                                                                                                                                              • SizeofResource.KERNEL32(00000000,00000000), ref: 00401E42
                                                                                                                                                                                                                                                                                              • LoadResource.KERNEL32(00000000,00000000), ref: 00401E4C
                                                                                                                                                                                                                                                                                              • LockResource.KERNEL32(00000000), ref: 00401E57
                                                                                                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 00401E83
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00401E8C
                                                                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00401EAB
                                                                                                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 00401EC0
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 00401EC3
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
                                                                                                                                                                                                                                                                                              • String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
                                                                                                                                                                                                                                                                                              • API String ID: 2639302590-365843014
                                                                                                                                                                                                                                                                                              • Opcode ID: f3b181bdb1dd7712d2262e78495c99b7539d7d08376e29593b7b35a4ee752d35
                                                                                                                                                                                                                                                                                              • Instruction ID: 0bae6d538d88249feec22e70dee6e974a297163e78d6f1732f828fb100938c5a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f3b181bdb1dd7712d2262e78495c99b7539d7d08376e29593b7b35a4ee752d35
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E02151B5940308BBDB119BA5DC08FDF3AADEB84715F158036FA05A7291DB78D940CBA8
                                                                                                                                                                                                                                                                                              Function 00408DD2 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • wvsprintfW.USER32(?,00000000,?), ref: 00408DF6
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00408E07
                                                                                                                                                                                                                                                                                              • FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,00406BA8), ref: 00408E2F
                                                                                                                                                                                                                                                                                              • FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00406BA8), ref: 00408E44
                                                                                                                                                                                                                                                                                              • lstrlenW.KERNEL32(?), ref: 00408E57
                                                                                                                                                                                                                                                                                              • lstrlenW.KERNEL32(?), ref: 00408E5E
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00408E73
                                                                                                                                                                                                                                                                                              • lstrcpyW.KERNEL32(00000000,?), ref: 00408E89
                                                                                                                                                                                                                                                                                              • lstrcpyW.KERNEL32(-00000002,?), ref: 00408E9A
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 00408EA3
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?), ref: 00408EAD
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 829399097-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 3cd6e96d682d9560081de5680e1c64890037530644a0209c6c139d25f2e832e1
                                                                                                                                                                                                                                                                                              • Instruction ID: 430b742eb51bd6d908813ed9783ba86da6981bd96c63e5e907f370e205208e14
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3cd6e96d682d9560081de5680e1c64890037530644a0209c6c139d25f2e832e1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B6218176900118BFDB149FA1DD85DEB3BBCFB48354B10407AFA45D6190EF34AA848BA4
                                                                                                                                                                                                                                                                                              Function 00402F12 Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FindFirstFileW.KERNEL32(?,?,004145D0,?,?,?,00000000), ref: 00402F41
                                                                                                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,004145CC,?,0000005C,?,?,?,00000000), ref: 00402F94
                                                                                                                                                                                                                                                                                              • lstrcmpW.KERNEL32(?,004145C4,?,?,00000000), ref: 00402FAA
                                                                                                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 00402FC0
                                                                                                                                                                                                                                                                                              • DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00402FC7
                                                                                                                                                                                                                                                                                              • FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 00402FD9
                                                                                                                                                                                                                                                                                              • FindClose.KERNEL32(00000000,?,?,00000000), ref: 00402FE8
                                                                                                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 00402FF3
                                                                                                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 00402FFC
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00403007
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00403012
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1862581289-0
                                                                                                                                                                                                                                                                                              • Opcode ID: fefa9183e0a8793aa5d56f092b45f2fd042b2c0c919ccf8fb62b9addc1ec799e
                                                                                                                                                                                                                                                                                              • Instruction ID: cb1819d8829f3ea853b928feda35cb2472adc35407fd345360bfd53aaca0e622
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fefa9183e0a8793aa5d56f092b45f2fd042b2c0c919ccf8fb62b9addc1ec799e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 55218030600219BADB20AF61DD8DEEE3B7C9F94745F10407AF905F20D1EB789A859A68
                                                                                                                                                                                                                                                                                              Function 00408643 Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 00408662
                                                                                                                                                                                                                                                                                              • SetWindowsHookExW.USER32(00000007,Function_00008589,00000000,00000000), ref: 0040866D
                                                                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 0040867C
                                                                                                                                                                                                                                                                                              • SetWindowsHookExW.USER32(00000002,Function_00008615,00000000,00000000), ref: 00408687
                                                                                                                                                                                                                                                                                              • EndDialog.USER32(?,00000000), ref: 004086AD
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CurrentHookThreadWindows$Dialog
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1967849563-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a0805c3b6262eedc2856a77b882f8b22c7f0eb3195d906f6a4b2a32eeb2a9efd
                                                                                                                                                                                                                                                                                              • Instruction ID: 75cd9ee5bc6f61fe2cb81be21b4fd125b80c6fdd5fd3af93018a39c96244cffa
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a0805c3b6262eedc2856a77b882f8b22c7f0eb3195d906f6a4b2a32eeb2a9efd
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5B01DBB1201218DFC2106B56EE84972F7ECE7943A6756443FEA4591160CEB79840CB68
                                                                                                                                                                                                                                                                                              Function 0040247A Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • AllocateAndInitializeSid.ADVAPI32(00406061,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,0000000A,-00000008,00406061,?,00000000,0000000A), ref: 004024B3
                                                                                                                                                                                                                                                                                              • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 004024C5
                                                                                                                                                                                                                                                                                              • FreeSid.ADVAPI32(?), ref: 004024CE
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3429775523-0
                                                                                                                                                                                                                                                                                              • Opcode ID: f95902cbba3d6f605503444b4f1013812362749f131f83053839915cbbdee454
                                                                                                                                                                                                                                                                                              • Instruction ID: 2f4618e6ceb2729e5ce81d0b7ff02b8ca2855782c3c39cce86a1747ea6c70431
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f95902cbba3d6f605503444b4f1013812362749f131f83053839915cbbdee454
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AAF03C72944288FEDB01DBE99D85ADEBF7CAB18300F4480AAA201A3182D2705704CB29
                                                                                                                                                                                                                                                                                              Function 0040506D Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCommandLineW.KERNEL32(?,?,?), ref: 0040508E
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00405151
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00405159
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00405161
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00405169
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 00405171
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 00405179
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 00405181
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 00405189
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 00405191
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405199
                                                                                                                                                                                                                                                                                              • GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004051B2
                                                                                                                                                                                                                                                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004051D9
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004051E3
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004051EE
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004051F6
                                                                                                                                                                                                                                                                                              • CreateJobObjectW.KERNEL32(00000000,00000000), ref: 0040520B
                                                                                                                                                                                                                                                                                              • AssignProcessToJobObject.KERNEL32(00000000,?), ref: 00405222
                                                                                                                                                                                                                                                                                              • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00405232
                                                                                                                                                                                                                                                                                              • SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 00405253
                                                                                                                                                                                                                                                                                              • ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040525C
                                                                                                                                                                                                                                                                                              • GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040527B
                                                                                                                                                                                                                                                                                              • ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405284
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040528B
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040529A
                                                                                                                                                                                                                                                                                              • GetExitCodeProcess.KERNEL32(?,?), ref: 004052A3
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004052AE
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004052BA
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004052C1
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004052CC
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
                                                                                                                                                                                                                                                                                              • String ID: " -$sfxwaitall
                                                                                                                                                                                                                                                                                              • API String ID: 2734624574-3991362806
                                                                                                                                                                                                                                                                                              • Opcode ID: 1651613734ca01c0ef639546651a2c1af69aadcd47dd11a8969eac25b6315bba
                                                                                                                                                                                                                                                                                              • Instruction ID: 7f61a69da49000c65074572d1fe98706f6aedafc1cd57d8e6ee043ebd50c0a44
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1651613734ca01c0ef639546651a2c1af69aadcd47dd11a8969eac25b6315bba
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22615EB2800108BBDF11AFA1DD46EDF3B6CFF48314F04453AFA15F21A1EA7999548B68
                                                                                                                                                                                                                                                                                              Function 00405333 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetDriveTypeW.KERNEL32(?,?,00000000), ref: 0040537A
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004053AB
                                                                                                                                                                                                                                                                                              • WriteFile.KERNEL32(00418818,?,?,00406D34,00000000,del ",:Repeat,00000000), ref: 00405460
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 0040546B
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00418818), ref: 00405474
                                                                                                                                                                                                                                                                                              • SetFileAttributesW.KERNEL32(00406D34,00000000), ref: 0040548B
                                                                                                                                                                                                                                                                                              • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0040549D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 004054A6
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 004054B2
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00406D34,?), ref: 004054B8
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00406D34,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00406D34,00418818), ref: 004054E6
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
                                                                                                                                                                                                                                                                                              • String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
                                                                                                                                                                                                                                                                                              • API String ID: 3007203151-3467708659
                                                                                                                                                                                                                                                                                              • Opcode ID: 9764de6719cad73f2f4297722ccddd7a232d0fdde84da56f987867140064e3fa
                                                                                                                                                                                                                                                                                              • Instruction ID: dd19172183314f13989176bb75b485d2f6e39d8bd015fd44596edd7a76c33576
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9764de6719cad73f2f4297722ccddd7a232d0fdde84da56f987867140064e3fa
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92413D71800109EADB10AF91DD86EEFBB79EF04358F10853AF511B60E1DB786E85CB68
                                                                                                                                                                                                                                                                                              Function 00403159 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetClassNameA.USER32(?,?,00000040), ref: 0040316C
                                                                                                                                                                                                                                                                                              • lstrcmpiA.KERNEL32(?,STATIC), ref: 0040317F
                                                                                                                                                                                                                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 0040318C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00403116: GetWindowTextLengthW.USER32(?), ref: 00403127
                                                                                                                                                                                                                                                                                                • Part of subcall function 00403116: GetWindowTextW.USER32(004031A0,00000000,00000001), ref: 00403144
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 004031B9
                                                                                                                                                                                                                                                                                              • GetParent.USER32(?), ref: 004031C7
                                                                                                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(riched20), ref: 004031DB
                                                                                                                                                                                                                                                                                              • GetMenu.USER32(?), ref: 004031EE
                                                                                                                                                                                                                                                                                              • SetThreadLocale.KERNEL32(00000419), ref: 004031FB
                                                                                                                                                                                                                                                                                              • CreateWindowExW.USER32(00000000,RichEdit20W,004144C8,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 0040322B
                                                                                                                                                                                                                                                                                              • DestroyWindow.USER32(?), ref: 0040323C
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00403251
                                                                                                                                                                                                                                                                                              • GetSysColor.USER32(0000000F), ref: 00403255
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00403263
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,00000461,?,?), ref: 0040328E
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 00403293
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 0040329B
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
                                                                                                                                                                                                                                                                                              • String ID: RichEdit20W$STATIC$riched20${\rtf
                                                                                                                                                                                                                                                                                              • API String ID: 3514532227-2281146334
                                                                                                                                                                                                                                                                                              • Opcode ID: 2e173aac5f1df50d8f91cfe0fab26b53496a8c1ae9c7b6845bbf74d5360c6637
                                                                                                                                                                                                                                                                                              • Instruction ID: f87ecbe388e0223389a063f86bd1e1dddf67b0c51ef4acd7a43fb054af45fbac
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2e173aac5f1df50d8f91cfe0fab26b53496a8c1ae9c7b6845bbf74d5360c6637
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0F319F72900108BFDB01AFE5DD49EEF7BBCAF48745F144036F600F2191DA749A818B68
                                                                                                                                                                                                                                                                                              Function 004086FE Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AC8), ref: 00408727
                                                                                                                                                                                                                                                                                              • LoadIconW.USER32(00000000), ref: 0040872A
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000032), ref: 0040873E
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000031), ref: 00408743
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AC8), ref: 0040874C
                                                                                                                                                                                                                                                                                              • LoadImageW.USER32(00000000), ref: 0040874F
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(?,00000080,00000001,?), ref: 0040876F
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408778
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B2), ref: 00408794
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B2), ref: 0040879E
                                                                                                                                                                                                                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 004087AA
                                                                                                                                                                                                                                                                                              • SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087B9
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B5), ref: 004087C7
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B5), ref: 004087D5
                                                                                                                                                                                                                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 004087E1
                                                                                                                                                                                                                                                                                              • SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087F0
                                                                                                                                                                                                                                                                                              • GetWindow.USER32(?,00000005), ref: 004088D6
                                                                                                                                                                                                                                                                                              • GetWindow.USER32(?,00000005), ref: 004088F2
                                                                                                                                                                                                                                                                                              • GetWindow.USER32(?,00000005), ref: 0040890A
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00408AC8), ref: 0040896A
                                                                                                                                                                                                                                                                                              • LoadIconW.USER32(00000000), ref: 00408971
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B1), ref: 00408990
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000), ref: 00408993
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407B3C: GetDlgItem.USER32(?,?), ref: 00407B46
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407B3C: GetWindowTextLengthW.USER32(00000000), ref: 00407B4D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407209: GetDlgItem.USER32(?,?), ref: 00407216
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407209: ShowWindow.USER32(00000000,?), ref: 0040722D
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3694754696-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 912d7ef425d6c6494e29e3deb2b18d2c0e92bb38c953af52e25b7107b56c7ff0
                                                                                                                                                                                                                                                                                              • Instruction ID: 039de319893d1fc2a2f677b1cd9d0fdeb06e220da667d6f51fbd84e31fd24c88
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 912d7ef425d6c6494e29e3deb2b18d2c0e92bb38c953af52e25b7107b56c7ff0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8E710EB03047056BE6117B61DE4AF3B3A99EB80754F10443EF692762D2CFBDAC408A5E
                                                                                                                                                                                                                                                                                              Function 00404B35 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 207stringCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • lstrcmpiW.KERNEL32(00000000,004156B8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404C11
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 00402202
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: wsprintfW.USER32 ref: 00402213
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402228
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetLastError.KERNEL32 ref: 0040222D
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402248
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040225B
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetLastError.KERNEL32 ref: 00402262
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: lstrcmpiW.KERNEL32(00000000,00404955), ref: 00402277
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402287
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: SetLastError.KERNEL32(?), ref: 004022AE
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: lstrlenA.KERNEL32(00415208), ref: 004022E2
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022FD
                                                                                                                                                                                                                                                                                                • Part of subcall function 004021B3: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 0040232F
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 00404D0E
                                                                                                                                                                                                                                                                                              • _wtol.MSVCRT ref: 00404D2A
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
                                                                                                                                                                                                                                                                                              • String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$Progress$Title$WarningTitle
                                                                                                                                                                                                                                                                                              • API String ID: 2725485552-1675048025
                                                                                                                                                                                                                                                                                              • Opcode ID: 4f3447e187b8d09034772c4e1f667da3943b2aa83526ce6edd17a205bd317e56
                                                                                                                                                                                                                                                                                              • Instruction ID: 0029bdf793b7ca219a6cf9bf5c630004183a1ad15403dcfd881f782f334e5f10
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f3447e187b8d09034772c4e1f667da3943b2aa83526ce6edd17a205bd317e56
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 405193F1D01108BFEB107B615D8A9EF36ACDA91358724443FFA14F22C1EABD4E85866D
                                                                                                                                                                                                                                                                                              Function 00401EDE Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetWindowDC.USER32(00000000), ref: 00401EEA
                                                                                                                                                                                                                                                                                              • GetDeviceCaps.GDI32(00000000,00000058), ref: 00401EF6
                                                                                                                                                                                                                                                                                              • MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401F0F
                                                                                                                                                                                                                                                                                              • GetObjectW.GDI32(?,00000018,?), ref: 00401F3E
                                                                                                                                                                                                                                                                                              • MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F49
                                                                                                                                                                                                                                                                                              • MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F53
                                                                                                                                                                                                                                                                                              • CreateCompatibleDC.GDI32(?), ref: 00401F61
                                                                                                                                                                                                                                                                                              • CreateCompatibleDC.GDI32(?), ref: 00401F68
                                                                                                                                                                                                                                                                                              • SelectObject.GDI32(00000000,?), ref: 00401F76
                                                                                                                                                                                                                                                                                              • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401F84
                                                                                                                                                                                                                                                                                              • SelectObject.GDI32(00000000,00000000), ref: 00401F8C
                                                                                                                                                                                                                                                                                              • SetStretchBltMode.GDI32(00000000,00000004), ref: 00401F94
                                                                                                                                                                                                                                                                                              • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401FB3
                                                                                                                                                                                                                                                                                              • GetCurrentObject.GDI32(00000000,00000007), ref: 00401FBC
                                                                                                                                                                                                                                                                                              • SelectObject.GDI32(00000000,?), ref: 00401FC9
                                                                                                                                                                                                                                                                                              • SelectObject.GDI32(00000000,?), ref: 00401FCF
                                                                                                                                                                                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00401FD8
                                                                                                                                                                                                                                                                                              • DeleteDC.GDI32(00000000), ref: 00401FDB
                                                                                                                                                                                                                                                                                              • ReleaseDC.USER32(00000000,?), ref: 00401FE2
                                                                                                                                                                                                                                                                                              • ReleaseDC.USER32(00000000,?), ref: 00401FF1
                                                                                                                                                                                                                                                                                              • CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 00401FFE
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3462224810-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b47bfa37766e864d5ac7c3bff5c7f29dd76547e571441b34574f095888733673
                                                                                                                                                                                                                                                                                              • Instruction ID: 5d1e451046eba931a8e7b73d6ea6690a392447b5a41005267d77fd745915eb74
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b47bfa37766e864d5ac7c3bff5c7f29dd76547e571441b34574f095888733673
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7A310776D40208BFDF215BE29D48EEF7FBDEB88761F108066F604A61A0C7754A50EB64
                                                                                                                                                                                                                                                                                              Function 00402009 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetClassNameA.USER32(?,?,00000040), ref: 0040201B
                                                                                                                                                                                                                                                                                              • lstrcmpiA.KERNEL32(?,STATIC), ref: 00402032
                                                                                                                                                                                                                                                                                              • GetWindowLongW.USER32(?,000000F0), ref: 00402045
                                                                                                                                                                                                                                                                                              • GetMenu.USER32(?), ref: 0040205A
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401DF5: GetModuleHandleW.KERNEL32(00000000), ref: 00401E00
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401DF5: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401E1D
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401DF5: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401E31
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401DF5: SizeofResource.KERNEL32(00000000,00000000), ref: 00401E42
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401DF5: LoadResource.KERNEL32(00000000,00000000), ref: 00401E4C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401DF5: LockResource.KERNEL32(00000000), ref: 00401E57
                                                                                                                                                                                                                                                                                              • GlobalAlloc.KERNEL32(00000040,00000010), ref: 0040208C
                                                                                                                                                                                                                                                                                              • memcpy.MSVCRT(00000000,00000000,00000010), ref: 00402099
                                                                                                                                                                                                                                                                                              • CoInitialize.OLE32(00000000), ref: 004020A2
                                                                                                                                                                                                                                                                                              • CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 004020AE
                                                                                                                                                                                                                                                                                              • OleLoadPicture.OLEAUT32(?,00000000,00000000,00415E04,?), ref: 004020D3
                                                                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(00000000), ref: 004020E3
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: GetWindowDC.USER32(00000000), ref: 00401EEA
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: GetDeviceCaps.GDI32(00000000,00000058), ref: 00401EF6
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401F0F
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: GetObjectW.GDI32(?,00000018,?), ref: 00401F3E
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F49
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F53
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: CreateCompatibleDC.GDI32(?), ref: 00401F61
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: CreateCompatibleDC.GDI32(?), ref: 00401F68
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: SelectObject.GDI32(00000000,?), ref: 00401F76
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401F84
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: SelectObject.GDI32(00000000,00000000), ref: 00401F8C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: SetStretchBltMode.GDI32(00000000,00000004), ref: 00401F94
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401FB3
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: GetCurrentObject.GDI32(00000000,00000007), ref: 00401FBC
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: SelectObject.GDI32(00000000,?), ref: 00401FC9
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: SelectObject.GDI32(00000000,?), ref: 00401FCF
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: DeleteDC.GDI32(00000000), ref: 00401FD8
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: DeleteDC.GDI32(00000000), ref: 00401FDB
                                                                                                                                                                                                                                                                                                • Part of subcall function 00401EDE: ReleaseDC.USER32(00000000,?), ref: 00401FE2
                                                                                                                                                                                                                                                                                              • GetObjectW.GDI32(00000000,00000018,?), ref: 00402115
                                                                                                                                                                                                                                                                                              • SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 00402129
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000010,00000172,00000000,?), ref: 0040213B
                                                                                                                                                                                                                                                                                              • GlobalFree.KERNEL32(00000000), ref: 00402150
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
                                                                                                                                                                                                                                                                                              • String ID: IMAGES$STATIC
                                                                                                                                                                                                                                                                                              • API String ID: 4202116410-1168396491
                                                                                                                                                                                                                                                                                              • Opcode ID: 75b4482697df260aab65a5a7941d5379e2b77aabc16fc078eb73c221e7c7ff8a
                                                                                                                                                                                                                                                                                              • Instruction ID: 91dfa6bffb294d6a5faa91ea44976e7f2bf651e64a1983605f27e53e7953ab13
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75b4482697df260aab65a5a7941d5379e2b77aabc16fc078eb73c221e7c7ff8a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C4416B71A00118FFCB119FA1DD4CDEE7F7DEF49741B0080A5F605AA2A0D7758A81DBA8
                                                                                                                                                                                                                                                                                              Function 00408B49 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407209: GetDlgItem.USER32(?,?), ref: 00407216
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407209: ShowWindow.USER32(00000000,?), ref: 0040722D
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B8), ref: 00408B76
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00408B85
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B5), ref: 00408BCC
                                                                                                                                                                                                                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 00408BD1
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B5), ref: 00408BE1
                                                                                                                                                                                                                                                                                              • SetWindowLongW.USER32(00000000), ref: 00408BE4
                                                                                                                                                                                                                                                                                              • GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00408C0A
                                                                                                                                                                                                                                                                                              • EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00408C1C
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B4), ref: 00408C26
                                                                                                                                                                                                                                                                                              • SetFocus.USER32(00000000), ref: 00408C29
                                                                                                                                                                                                                                                                                              • SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408C58
                                                                                                                                                                                                                                                                                              • CoCreateInstance.OLE32(00415E34,00000000,00000001,00415B08,?), ref: 00408C7C
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,00000002), ref: 00408C99
                                                                                                                                                                                                                                                                                              • IsWindow.USER32(00000000), ref: 00408C9C
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,00000002), ref: 00408CAC
                                                                                                                                                                                                                                                                                              • EnableWindow.USER32(00000000), ref: 00408CAF
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B5), ref: 00408CC3
                                                                                                                                                                                                                                                                                              • ShowWindow.USER32(00000000), ref: 00408CC6
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407A6A: GetDlgItem.USER32(?,000004B6), ref: 00407A78
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AC8), ref: 00408727
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: LoadIconW.USER32(00000000), ref: 0040872A
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetSystemMetrics.USER32(00000032), ref: 0040873E
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetSystemMetrics.USER32(00000031), ref: 00408743
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AC8), ref: 0040874C
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: LoadImageW.USER32(00000000), ref: 0040874F
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: SendMessageW.USER32(?,00000080,00000001,?), ref: 0040876F
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408778
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B2), ref: 00408794
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B2), ref: 0040879E
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetWindowLongW.USER32(?,000000F0), ref: 004087AA
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087B9
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B5), ref: 004087C7
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B5), ref: 004087D5
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetWindowLongW.USER32(?,000000F0), ref: 004087E1
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087F0
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1057135554-0
                                                                                                                                                                                                                                                                                              • Opcode ID: eaf23160efd0307f89d7b68af9e71152053e371a4570ee8adff50cbc9787fa7e
                                                                                                                                                                                                                                                                                              • Instruction ID: 224722099809db51628d05960710a87cde38d463417800169f27d4d88e92d86b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: eaf23160efd0307f89d7b68af9e71152053e371a4570ee8adff50cbc9787fa7e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 98418B70604708AFEA206F66DE49F577BADEB80B04F11843DF555A62E1CF79B840CA2C
                                                                                                                                                                                                                                                                                              Function 00407324 Relevance: 24.3, APIs: 16, Instructions: 294COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B3), ref: 0040734C
                                                                                                                                                                                                                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 00407351
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B4), ref: 00407388
                                                                                                                                                                                                                                                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 0040738D
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000010), ref: 0040740F
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000011), ref: 00407415
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000008), ref: 0040741C
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000007), ref: 00407423
                                                                                                                                                                                                                                                                                              • GetParent.USER32(?), ref: 00407447
                                                                                                                                                                                                                                                                                              • GetClientRect.USER32(00000000,?), ref: 00407459
                                                                                                                                                                                                                                                                                              • ClientToScreen.USER32(?,?), ref: 0040746C
                                                                                                                                                                                                                                                                                              • SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 004074D2
                                                                                                                                                                                                                                                                                              • GetClientRect.USER32(?,?), ref: 0040756C
                                                                                                                                                                                                                                                                                                • Part of subcall function 004072F5: GetDlgItem.USER32(?,?), ref: 00407313
                                                                                                                                                                                                                                                                                                • Part of subcall function 004072F5: SetWindowPos.USER32(00000000), ref: 0040731A
                                                                                                                                                                                                                                                                                              • ClientToScreen.USER32(?,?), ref: 00407475
                                                                                                                                                                                                                                                                                                • Part of subcall function 004071EC: GetDlgItem.USER32(?,?), ref: 004071F8
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000008), ref: 004075F1
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000007), ref: 004075F8
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 747815384-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 35f39b259cb15be5e21bf055192cb3e2893df2de53a1a99aaff2ca9cd82b522a
                                                                                                                                                                                                                                                                                              • Instruction ID: a0ad394a55fa0a1721489591c3d48553244f7f891a42e1949470b4e54b7fd047
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 35f39b259cb15be5e21bf055192cb3e2893df2de53a1a99aaff2ca9cd82b522a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B2A12A71E04209AFDB14CFB9CD85AEEBBF9EB48304F148529E905F3291D778E9408B65
                                                                                                                                                                                                                                                                                              Function 0040342C Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 264COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,004183B0,00000000), ref: 004034B5
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,004183B0,00000000), ref: 004034BD
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00404738,?), ref: 004036E3
                                                                                                                                                                                                                                                                                                • Part of subcall function 004026C6: ??3@YAXPAX@Z.MSVCRT(?,-00000008,00404A61,?,?,?), ref: 004026CC
                                                                                                                                                                                                                                                                                                • Part of subcall function 004026C6: ??3@YAXPAX@Z.MSVCRT(?,?,-00000008,00404A61,?,?,?), ref: 004026D3
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00404738,?,?,00000000,00000000,004183B0,00000000), ref: 00403710
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@
                                                                                                                                                                                                                                                                                              • String ID: 0FA$SetEnvironment${\rtf
                                                                                                                                                                                                                                                                                              • API String ID: 613200358-2399711308
                                                                                                                                                                                                                                                                                              • Opcode ID: 815450e4ddcb86d512666d4464849088acf7f8bc4e05b7daeeaa442e47177da6
                                                                                                                                                                                                                                                                                              • Instruction ID: a9b0ba56adfd3770e1cd5829527a668cbe659d9fbc84a1bfbaef92eb180e3906
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 815450e4ddcb86d512666d4464849088acf7f8bc4e05b7daeeaa442e47177da6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A91BF71900109BBCF21EF91CC46AEEBB78AF1430AF20447BE941772E1DA795B46DB49
                                                                                                                                                                                                                                                                                              Function 00407852 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetParent.USER32(?), ref: 00407860
                                                                                                                                                                                                                                                                                              • GetWindowLongW.USER32(00000000), ref: 00407867
                                                                                                                                                                                                                                                                                              • DefWindowProcW.USER32(?,?,?,?), ref: 0040787D
                                                                                                                                                                                                                                                                                              • CallWindowProcW.USER32(?,?,?,?,?), ref: 0040789A
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000031), ref: 004078AC
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000032), ref: 004078B3
                                                                                                                                                                                                                                                                                              • GetWindowDC.USER32(?), ref: 004078C5
                                                                                                                                                                                                                                                                                              • GetWindowRect.USER32(?,?), ref: 004078D2
                                                                                                                                                                                                                                                                                              • DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 00407906
                                                                                                                                                                                                                                                                                              • ReleaseDC.USER32(?,00000000), ref: 0040790E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2586545124-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 3ece1157a758dadcf56a3a709e15e99760e1987f316051d3c357604a5bc7be5e
                                                                                                                                                                                                                                                                                              • Instruction ID: 52be0402dc7b357b4bf34bc6e6a675404a41cf5866785f5d5035100a8e7da033
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ece1157a758dadcf56a3a709e15e99760e1987f316051d3c357604a5bc7be5e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3B21FC7660021ABFDB019FA8ED48EDF3BADFB48351F048521FA15E2191CB74E920CB65
                                                                                                                                                                                                                                                                                              Function 00403BCE Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403C15
                                                                                                                                                                                                                                                                                                • Part of subcall function 00402A39: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00402AAC
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403C3B
                                                                                                                                                                                                                                                                                              • wsprintfA.USER32 ref: 00403C5D
                                                                                                                                                                                                                                                                                              • wsprintfA.USER32 ref: 00403C8A
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$wsprintf
                                                                                                                                                                                                                                                                                              • String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
                                                                                                                                                                                                                                                                                              • API String ID: 2704270482-695273242
                                                                                                                                                                                                                                                                                              • Opcode ID: cc1a3afb3d883613eeb8b3e353601ebd9c1b56f063cebdfa8a125c728cc411fe
                                                                                                                                                                                                                                                                                              • Instruction ID: 1b8667397c12d336e930ce8dd478f3c0f5fcbcef1a4eca0425c6607baeb60929
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cc1a3afb3d883613eeb8b3e353601ebd9c1b56f063cebdfa8a125c728cc411fe
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F12121B17005086BDF05EAA58D85EFE73ADAB88708F14402EB505F31C1DBBCAA458759
                                                                                                                                                                                                                                                                                              Function 00404F96 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78synchronizationCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • memset.MSVCRT ref: 00404FBA
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,00000000), ref: 00405013
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 0040501B
                                                                                                                                                                                                                                                                                              • ShellExecuteExW.SHELL32(?), ref: 00405039
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00406A98,000000FF), ref: 00405051
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00406A98), ref: 0040505A
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 00405061
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
                                                                                                                                                                                                                                                                                              • String ID: $WA
                                                                                                                                                                                                                                                                                              • API String ID: 2700081640-874810811
                                                                                                                                                                                                                                                                                              • Opcode ID: 15d7d94921ca385940e4122565536b427648d2303b2bb8e69fba9e7ea8f78c89
                                                                                                                                                                                                                                                                                              • Instruction ID: 8cdcfedd5936f543e78769933c75d32c6245f9f3c5592d88d5a60bc16fc1c1df
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 15d7d94921ca385940e4122565536b427648d2303b2bb8e69fba9e7ea8f78c89
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C0216D71804209ABDF11EF95D845AEFBBB8EF44318F10812BFA15B61A0DB785989CF84
                                                                                                                                                                                                                                                                                              Function 00407057 Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B3), ref: 0040706B
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 0040707E
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B4), ref: 00407088
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 00407090
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004070A0
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,?), ref: 004070A9
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004070B1
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,?), ref: 004070BA
                                                                                                                                                                                                                                                                                              • SetFocus.USER32(00000000,?,?,00000000,00407FAE,000004B3,00000000,?,000004B3), ref: 004070BD
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ItemMessageSend$Focus
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3946207451-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 0fc6dd28cd98c92534448f4fcc92f52223e7101c96fd3207fd34216a5bdc41e5
                                                                                                                                                                                                                                                                                              • Instruction ID: 5d9f80474de4dcc3f376415b50596b4d6f25ba69a104e928cd55d4f6a31a8c04
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0fc6dd28cd98c92534448f4fcc92f52223e7101c96fd3207fd34216a5bdc41e5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 46F04F712403087BEA212B61DD86F9BBA5EDF80B94F018425F350660F0CBF3AC509A28
                                                                                                                                                                                                                                                                                              Function 00407678 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(uxtheme,?,004089BB,000004B1,00000000,?,?,?,?,?,00408AC8), ref: 00407680
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407691
                                                                                                                                                                                                                                                                                              • GetWindow.USER32(?,00000005), ref: 004076AA
                                                                                                                                                                                                                                                                                              • GetWindow.USER32(00000000,00000002), ref: 004076C0
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Window$AddressLibraryLoadProc
                                                                                                                                                                                                                                                                                              • String ID: XA$SetWindowTheme$uxtheme
                                                                                                                                                                                                                                                                                              • API String ID: 324724604-3019689983
                                                                                                                                                                                                                                                                                              • Opcode ID: 1868035f0e72e64a460ab4f3ad1c9a181874f3c559f2ba787c374269699430c0
                                                                                                                                                                                                                                                                                              • Instruction ID: f904700b681b15efec0ce33b5b1de5db2a7474ba9eb9f73b1446f12cb5275619
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1868035f0e72e64a460ab4f3ad1c9a181874f3c559f2ba787c374269699430c0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8F02732A45F2573C231126A6C48EAB7A9CDFC5B307064536B804F7380DA6ADC4081ED
                                                                                                                                                                                                                                                                                              Function 004076CD Relevance: 12.1, APIs: 8, Instructions: 69COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • memcpy.MSVCRT(?,00418428,00000160), ref: 004076EC
                                                                                                                                                                                                                                                                                              • SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 0040770B
                                                                                                                                                                                                                                                                                              • GetDC.USER32(00000000), ref: 00407716
                                                                                                                                                                                                                                                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407722
                                                                                                                                                                                                                                                                                              • MulDiv.KERNEL32(?,00000048,00000000), ref: 00407731
                                                                                                                                                                                                                                                                                              • ReleaseDC.USER32(00000000,?), ref: 0040773F
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 00407767
                                                                                                                                                                                                                                                                                              • DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00006F0F), ref: 0040779C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2693764856-0
                                                                                                                                                                                                                                                                                              • Opcode ID: f31c46d79efd12f0c6e31496684c0613d70d8776a133cac82a1eefdee8320659
                                                                                                                                                                                                                                                                                              • Instruction ID: afc10ac911df07e4e6cf66ea75b89f896700515d4e888b71f534ad2bf84f0f11
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f31c46d79efd12f0c6e31496684c0613d70d8776a133cac82a1eefdee8320659
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5321D5B1940219BFD7215FA19C89EEB7B7CFF44741F0000B6FA09E2290D7345E948B69
                                                                                                                                                                                                                                                                                              Function 0040723B Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetDC.USER32(?), ref: 0040724B
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(0000000B), ref: 00407267
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(0000003D), ref: 00407270
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(0000003E), ref: 00407278
                                                                                                                                                                                                                                                                                              • SelectObject.GDI32(?,?), ref: 00407295
                                                                                                                                                                                                                                                                                              • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004072B0
                                                                                                                                                                                                                                                                                              • SelectObject.GDI32(?,?), ref: 004072D6
                                                                                                                                                                                                                                                                                              • ReleaseDC.USER32(?,?), ref: 004072E5
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: MetricsSystem$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2466489532-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 3fc5bb8d8ce0059ed4a313ac0909580b77e08559f279fdacdcb38977844fadab
                                                                                                                                                                                                                                                                                              • Instruction ID: 6f10caf3c91ec906ab8c69a2f752e165f8fbbbb970a8871ef44e176c1e6f5179
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3fc5bb8d8ce0059ed4a313ac0909580b77e08559f279fdacdcb38977844fadab
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ED216A72900209AFCB018FA5DD44A8EBFF4EF48360F11C4AAF519A72A0D335AA40DF44
                                                                                                                                                                                                                                                                                              Function 0040CD59 Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 42COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _CxxThrowException.MSVCRT(x\A,00415FC8), ref: 0040CDF1
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExceptionThrow
                                                                                                                                                                                                                                                                                              • String ID: $\A$4\A$D\A$T\A$h\A$x\A$x\A
                                                                                                                                                                                                                                                                                              • API String ID: 432778473-4237324355
                                                                                                                                                                                                                                                                                              • Opcode ID: 42af2ecacb29d270843999158bbdf4f88e41a002526f962cdbd600073b257eea
                                                                                                                                                                                                                                                                                              • Instruction ID: 4c22c63eab4b6001538c3dc2317f457de0ef6912c253ce436c5b2a5e9cf33ab3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42af2ecacb29d270843999158bbdf4f88e41a002526f962cdbd600073b257eea
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 771190B0511F44DBC730DF16D5884CAFBF8AF957187108A1FD19A9BA50E3F8A189CB98
                                                                                                                                                                                                                                                                                              Function 004081A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081E3
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B8), ref: 00408201
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 00408213
                                                                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00408231
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 004082C9
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
                                                                                                                                                                                                                                                                                              • String ID: %d%%
                                                                                                                                                                                                                                                                                              • API String ID: 3753976982-1518462796
                                                                                                                                                                                                                                                                                              • Opcode ID: 4834618e73f83458aad26a7206775ecf8ed0c509a94533082d5cf67e45c18303
                                                                                                                                                                                                                                                                                              • Instruction ID: d547d5554fea010f519209f47393056b7b5c94104caa36f0b20f7048e519bd49
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4834618e73f83458aad26a7206775ecf8ed0c509a94533082d5cf67e45c18303
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6B31B131900704BBCB11AFA0DE45EDA7BB9FF44704F10846EF646A62E1CB79AA10CB58
                                                                                                                                                                                                                                                                                              Function 004083C0 Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • EndDialog.USER32(?,00000000), ref: 004083DA
                                                                                                                                                                                                                                                                                              • KillTimer.USER32(?,00000001), ref: 004083EB
                                                                                                                                                                                                                                                                                              • SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408415
                                                                                                                                                                                                                                                                                              • SuspendThread.KERNEL32(00000290), ref: 0040842E
                                                                                                                                                                                                                                                                                              • ResumeThread.KERNEL32(00000290), ref: 0040844B
                                                                                                                                                                                                                                                                                              • EndDialog.USER32(?,00000000), ref: 0040846D
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: DialogThreadTimer$KillResumeSuspend
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4151135813-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e75cb11098a165f3e00a93ead61a02ee0602d1603e20a081ddaa5bed579dc4cd
                                                                                                                                                                                                                                                                                              • Instruction ID: 48b16cdcac2f029ef5c3ce809d25cb41ce606689494225ec37f78696aa4d263a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e75cb11098a165f3e00a93ead61a02ee0602d1603e20a081ddaa5bed579dc4cd
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 79118F71600209AFD7202F62FE84AA73BADEB80B45714C43EF596A11B1DF359C01DA5C
                                                                                                                                                                                                                                                                                              Function 0040405E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041472C,?,?,00000000,0040464E,?,?,00000000,?,?,0040628F,?), ref: 004040A4
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041471C,?,?,?,%%M\,0041472C,?,?,00000000,0040464E,?,?), ref: 004040E2
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041471C,?,?,?,%%M\,0041472C,?,?,00000000), ref: 00404108
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041471C,?,?,?,%%M\,0041472C,?,?), ref: 00404110
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@
                                                                                                                                                                                                                                                                                              • String ID: %%M/$%%M\
                                                                                                                                                                                                                                                                                              • API String ID: 613200358-4143866494
                                                                                                                                                                                                                                                                                              • Opcode ID: 8d74330d7c47e7ec155605d8972836f8cd90317b8a684ae5ad7c9bd0a89d9626
                                                                                                                                                                                                                                                                                              • Instruction ID: ae7ccff3c4984ef899f0664094611f881c6179175724c87e9ac4d6adf99dc5ad
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8d74330d7c47e7ec155605d8972836f8cd90317b8a684ae5ad7c9bd0a89d9626
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF11D73190010EAACF05FFA1D956DEEBB79AF00318F50456AB521760E1DBB86699CB88
                                                                                                                                                                                                                                                                                              Function 00403EE8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041472C,?,?,00000000,0040464E,?,?,00000000,?,?,0040628F,?), ref: 00403F2E
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041471C,?,?,?,%%T\,0041472C,?,?,00000000,0040464E,?,?), ref: 00403F6C
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041471C,?,?,?,%%T\,0041472C,?,?,00000000), ref: 00403F92
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041471C,?,?,?,%%T\,0041472C,?,?), ref: 00403F9A
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@
                                                                                                                                                                                                                                                                                              • String ID: %%T/$%%T\
                                                                                                                                                                                                                                                                                              • API String ID: 613200358-2679640699
                                                                                                                                                                                                                                                                                              • Opcode ID: 00b623cf612c74aa8f2fb87727e921c33523463c9af7ccc1e427d662d593664c
                                                                                                                                                                                                                                                                                              • Instruction ID: 1540654d000bee33f0bf236bf2786ca3bc36bf969bc56e1bcbd04563868c3890
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 00b623cf612c74aa8f2fb87727e921c33523463c9af7ccc1e427d662d593664c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F11073190010EAACF05FFA1D946CEEBB39AF00318F10452AB511724E1DBB86699CB98
                                                                                                                                                                                                                                                                                              Function 00403FA3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041472C,?,?,00000000,0040464E,?,?,00000000,?,?,0040628F,?), ref: 00403FE9
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041471C,?,?,?,%%S\,0041472C,?,?,00000000,0040464E,?,?), ref: 00404027
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041471C,?,?,?,%%S\,0041472C,?,?,00000000), ref: 0040404D
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041471C,?,?,?,%%S\,0041472C,?,?), ref: 00404055
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@
                                                                                                                                                                                                                                                                                              • String ID: %%S/$%%S\
                                                                                                                                                                                                                                                                                              • API String ID: 613200358-358529586
                                                                                                                                                                                                                                                                                              • Opcode ID: 0d325b822506a746de723ed7a2266f3842419fb082db078651a1263f39a8f9fc
                                                                                                                                                                                                                                                                                              • Instruction ID: 46769830cf2248f7da0d90b8b5e5a17041a4a2d7ad556ba568fe6d8d869660d1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0d325b822506a746de723ed7a2266f3842419fb082db078651a1263f39a8f9fc
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9F11E93190010EBACF05FFA1DD56DEEBB79AF0031CF50456AB521720E1DBB86699CB88
                                                                                                                                                                                                                                                                                              Function 004054F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00418818,00000001,00418818,00418818,00000001,?,00000000), ref: 00405572
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00418818,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041841C,00418818,00000001,?,00000000), ref: 004055D4
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00418818,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041841C,00418818,00000001,?,00000000), ref: 004055EC
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040371D: lstrlenW.KERNEL32(004017FB,00000000,?,?,?,?,?,?,004017FB,?), ref: 0040372A
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040371D: GetSystemTimeAsFileTime.KERNEL32(?,004017FB,?,?,?,?,004017FB,?), ref: 004037A0
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040371D: GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017FB,?), ref: 004037A7
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040371D: ??3@YAXPAX@Z.MSVCRT(?,004017FB,?,?,?,?,004017FB,?), ref: 00403866
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$FileTime$AttributesSystemlstrlen
                                                                                                                                                                                                                                                                                              • String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
                                                                                                                                                                                                                                                                                              • API String ID: 4038993085-372238525
                                                                                                                                                                                                                                                                                              • Opcode ID: 2a85efb9fc4df3f664930e950edea05c435a2d0503b340e68b98611daed76cd9
                                                                                                                                                                                                                                                                                              • Instruction ID: e37cdd1bb20b18eb0c9aa4d9d77910c01642be129359a522859184d78abb527a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2a85efb9fc4df3f664930e950edea05c435a2d0503b340e68b98611daed76cd9
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8131377580021EAACF05EF92CD819EEBB75FF54318F10042BE811B22E1DB795A45DB58
                                                                                                                                                                                                                                                                                              Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: wsprintf$ExitProcesslstrcat
                                                                                                                                                                                                                                                                                              • String ID: 0x%p
                                                                                                                                                                                                                                                                                              • API String ID: 2530384128-1745605757
                                                                                                                                                                                                                                                                                              • Opcode ID: efaa74bb8e783b89e2550c26a3ba915e44d67ba2621a20dac2b5c57b7e42c894
                                                                                                                                                                                                                                                                                              • Instruction ID: 1314f2abe56a8853062125fdc791d10c761366de72a6b198a385f2dfa53c0856
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: efaa74bb8e783b89e2550c26a3ba915e44d67ba2621a20dac2b5c57b7e42c894
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4E1142B1800208AFDB20EFA4DE859DA77B8BF44304F10447BE645E3591DB74AA948F69
                                                                                                                                                                                                                                                                                              Function 00407DD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • memset.MSVCRT ref: 00407DE5
                                                                                                                                                                                                                                                                                              • SHBrowseForFolderW.SHELL32(?), ref: 00407DFE
                                                                                                                                                                                                                                                                                              • SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 00407E1A
                                                                                                                                                                                                                                                                                              • SHGetMalloc.SHELL32(00000000), ref: 00407E44
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407BBF: GetDlgItem.USER32(?,000004B6), ref: 00407BCC
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407BBF: SetFocus.USER32(00000000,?,?,00407CB3,000004B6,?), ref: 00407BD3
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: BrowseFocusFolderFromItemListMallocPathmemset
                                                                                                                                                                                                                                                                                              • String ID: A
                                                                                                                                                                                                                                                                                              • API String ID: 1557639607-3554254475
                                                                                                                                                                                                                                                                                              • Opcode ID: 2b098266b39b3f668ca56778adddcd14bb4c1f8d57c6151e1855998d85c55c2b
                                                                                                                                                                                                                                                                                              • Instruction ID: a4824954b2f530c4be457b4d48ab3620df28fe7afd7e0c092b1d321795545aed
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b098266b39b3f668ca56778adddcd14bb4c1f8d57c6151e1855998d85c55c2b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 58112471A042049BDB10DBA5D988BDE77BCAB84744F1000B9E905E7280DB78EF44CBB5
                                                                                                                                                                                                                                                                                              Function 00402B9D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402BCE
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 00402BD7
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040119E: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011BE
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040119E: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011E4
                                                                                                                                                                                                                                                                                              • ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402BEF
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402C0F
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$EnvironmentExpandStrings$??2@
                                                                                                                                                                                                                                                                                              • String ID: SetEnvironment
                                                                                                                                                                                                                                                                                              • API String ID: 612612615-360490078
                                                                                                                                                                                                                                                                                              • Opcode ID: 55d31c0c8e8d43e4bc40bd8419a98e00ed9ee3417a8b330f63c4d1dc32bb4481
                                                                                                                                                                                                                                                                                              • Instruction ID: 7a1986039434bfea8fb976bad68b9fec1708bfa62b9b7c4d92bd289c52dd9e7c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 55d31c0c8e8d43e4bc40bd8419a98e00ed9ee3417a8b330f63c4d1dc32bb4481
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE015272D04108BADB15AF95ED85DEEB77CAF44314F10406BF901F31D1EBB46A808A98
                                                                                                                                                                                                                                                                                              Function 00404677 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • lstrlenW.KERNEL32(004183B0,00000020,-00000002,-00000004,0040601F,-00000002,?,?,00000000,0000000A), ref: 00404690
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00404742
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 0040474A
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00404759
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00404761
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$lstrlen
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2031685711-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 9dd4e087dfebdb7adc829e694212170b53856bb28406c9df5260f1851f0cfc14
                                                                                                                                                                                                                                                                                              • Instruction ID: e452c8b9580ad5b4e9c5ad8253c2bd18b5e641b8773d8d819885c06dfbd1aa5e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9dd4e087dfebdb7adc829e694212170b53856bb28406c9df5260f1851f0cfc14
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F21F7B6D00204ABCF206FA0C805AEB77A8EF96354F14487BEA41B72D1E77D59858698
                                                                                                                                                                                                                                                                                              Function 004080B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407A9A: GetSystemMetrics.USER32(0000000B), ref: 00407AC2
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407A9A: GetSystemMetrics.USER32(0000000C), ref: 00407ACB
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000007), ref: 004080C7
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000007), ref: 004080D8
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 0040819F
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: MetricsSystem$??3@
                                                                                                                                                                                                                                                                                              • String ID: 100%%
                                                                                                                                                                                                                                                                                              • API String ID: 2562992111-568723177
                                                                                                                                                                                                                                                                                              • Opcode ID: 231875b45a637f34d9f9c3f5c9e0aa16ca98c8cd5888c3b0cb21755736041274
                                                                                                                                                                                                                                                                                              • Instruction ID: 361b5331053c267c82135be000a438b6f2aafb9a8e426eb0e0de44657c638489
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 231875b45a637f34d9f9c3f5c9e0aa16ca98c8cd5888c3b0cb21755736041274
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1031A271A007059FCB20DF69CE459AEB7F4AF50708B10052ED582A62D1DB74FE45CBA9
                                                                                                                                                                                                                                                                                              Function 00404EC8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407CB6: GetSystemMetrics.USER32(00000010), ref: 00407CF8
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407CB6: GetSystemMetrics.USER32(00000011), ref: 00407D06
                                                                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 00404F48
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(004058A1,00000011,004058A1,00000000,004156D0,?), ref: 00404F85
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: MetricsSystem$??3@wsprintf
                                                                                                                                                                                                                                                                                              • String ID: %X - %03X - %03X - %03X - %03X$xSA
                                                                                                                                                                                                                                                                                              • API String ID: 1174869416-2200552790
                                                                                                                                                                                                                                                                                              • Opcode ID: 5e99973b4770436b31ae6ebce53f387213bf9e7a1f7abe49b1e3923643a300da
                                                                                                                                                                                                                                                                                              • Instruction ID: 40de33091f6d7bfb9cb16c884b275a10ef5d6579019540d7c3242ae87892468d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5e99973b4770436b31ae6ebce53f387213bf9e7a1f7abe49b1e3923643a300da
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8D117C71D4421CABDB11AB90DD46FEDB334BB44708F20417EB6597A0E2DBB82A44CB99
                                                                                                                                                                                                                                                                                              Function 00404247 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • lstrlenW.KERNEL32(|g@,00000000,?,00000000,0040428E,00000000,00000000,0040677C,?,waitall,00000000,00000000,?,?,004187D0), ref: 00404254
                                                                                                                                                                                                                                                                                              • lstrlenW.KERNEL32(?,?,?,004187D0), ref: 0040425D
                                                                                                                                                                                                                                                                                              • _wcsnicmp.MSVCRT ref: 00404269
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: lstrlen$_wcsnicmp
                                                                                                                                                                                                                                                                                              • String ID: |g@
                                                                                                                                                                                                                                                                                              • API String ID: 2823567412-4274713814
                                                                                                                                                                                                                                                                                              • Opcode ID: 8992e580c2879bf2cf1974d0f1fd0d83e29de68f0bfec66311d505a649ea88d3
                                                                                                                                                                                                                                                                                              • Instruction ID: 91fd41af1b4c5a631b7d1c9a566814b64cdbe312f0f5f3dcf94e635f0d89012e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8992e580c2879bf2cf1974d0f1fd0d83e29de68f0bfec66311d505a649ea88d3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 13E04F726042155BCA008BA5AC84C4B7BADEAC8399B14087AF700D2161E735D8158BB5
                                                                                                                                                                                                                                                                                              Function 004023E1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00406ACC,00000000,?,?), ref: 004023F4
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 004023FB
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                                                                                                              • String ID: Wow64RevertWow64FsRedirection$kernel32
                                                                                                                                                                                                                                                                                              • API String ID: 2574300362-3900151262
                                                                                                                                                                                                                                                                                              • Opcode ID: fc8a105a084ed9362e95b51bbe18b35c476ad17b6e1470a8481edb99e814b72d
                                                                                                                                                                                                                                                                                              • Instruction ID: e6431754f0bb42eea3281cd090f065db593f33429da415fe5b8d4e5d76c2fc8e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc8a105a084ed9362e95b51bbe18b35c476ad17b6e1470a8481edb99e814b72d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 46D0C970281201BBD7541BB0EE0DBD636A9E7C0B0AF64C53AA510A00F1CFBC84C0CA2C
                                                                                                                                                                                                                                                                                              Function 00402415 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,0040246B,?,00406A06,?,00000000,?,?), ref: 00402426
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000), ref: 0040242D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                                                                                                              • String ID: Wow64DisableWow64FsRedirection$kernel32
                                                                                                                                                                                                                                                                                              • API String ID: 2574300362-736604160
                                                                                                                                                                                                                                                                                              • Opcode ID: 37665ca539f3be4570db02a906197ebf596f47f328cc02b1eb8054edfcc0c386
                                                                                                                                                                                                                                                                                              • Instruction ID: 356b9ffe611459cab99037cfc994ce0ef5e0ec7a2b6c4e96b739cb0aff8c561e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 37665ca539f3be4570db02a906197ebf596f47f328cc02b1eb8054edfcc0c386
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 60D0C9702812007BD7505BA4DD0DBC535A4ABD0B06F7080396114910E0CAFC8080C62D
                                                                                                                                                                                                                                                                                              Function 00402E02 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00405831,00405831,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831,00000000,00000000), ref: 00402F08
                                                                                                                                                                                                                                                                                                • Part of subcall function 00402B04: MultiByteToWideChar.KERNEL32(00000020,00000000,00000024,?,00000000,?,?,00000020,00000024,00000000,00402E66,?,?,00000000,00000000,00000000), ref: 00402B36
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831,00000000), ref: 00402E75
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831), ref: 00402E90
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?), ref: 00402E98
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@$ByteCharMultiWide
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1731127917-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 40547eccd8cc46b9ce6e63df0a08723ac82a013a06524bbcda7c7baf18969fb4
                                                                                                                                                                                                                                                                                              • Instruction ID: 1cb3068dceb16179bed37d7bcba6770f4cb49ce50885e45661cd5ff88b0b85c6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 40547eccd8cc46b9ce6e63df0a08723ac82a013a06524bbcda7c7baf18969fb4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F3319172844119AADB04FBA6DD469EF73B8EF40318F10443FF857B25E1EA7CA9448698
                                                                                                                                                                                                                                                                                              Function 00404571 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00406D34,00000000,?,?,00405397,?,7ZSfx%03x.cmd), ref: 00404594
                                                                                                                                                                                                                                                                                              • GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,00405397,?,7ZSfx%03x.cmd), ref: 004045B1
                                                                                                                                                                                                                                                                                              • wsprintfW.USER32 ref: 004045E7
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32(?), ref: 00404602
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: PathTemp$AttributesFilewsprintf
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1746483863-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 82427edfe5bfc4f19eec22ff1e03e6e09f811527fc585024896cf2e26f26031f
                                                                                                                                                                                                                                                                                              • Instruction ID: 38ee7099452fd1027c0558441710595ee25a108be248788551c438e886588400
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 82427edfe5bfc4f19eec22ff1e03e6e09f811527fc585024896cf2e26f26031f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DB112472100204BFD7119F59DC84AADB7F8FF84354F10802EF905972E1DBB9A950CB98
                                                                                                                                                                                                                                                                                              Function 0040C2CE Relevance: 6.1, APIs: 4, Instructions: 58COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _CxxThrowException.MSVCRT(00100EC3,00415FC8), ref: 0040C2F9
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000004,0041839C,0041839C,00000000,?,0040C3C6,00000000,0040D7BD,0041839C,0040332B,00000000,00000000,00404A21,?,?,?), ref: 0040C321
                                                                                                                                                                                                                                                                                              • memcpy.MSVCRT(00000000,00000000,00000004,0041839C,0041839C,00000000,?,0040C3C6,00000000,0040D7BD,0041839C,0040332B,00000000,00000000,00404A21,?), ref: 0040C34A
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,0041839C,0041839C,00000000,?,0040C3C6,00000000,0040D7BD,0041839C,0040332B,00000000,00000000,00404A21,?,?,?), ref: 0040C355
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@??3@ExceptionThrowmemcpy
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3462485524-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e35e2fcde5cebdb1bdfbc3790ab06a107399000894f53a8827949261d48e50b2
                                                                                                                                                                                                                                                                                              • Instruction ID: a52cf72bba6676f7490f1024090531b7bd79135e1d2ccc858ac5def135e82823
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e35e2fcde5cebdb1bdfbc3790ab06a107399000894f53a8827949261d48e50b2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7211E572600304ABCB289F56C9C1D5BF7E9AB84350710CA3FF919E7681C775E8864758
                                                                                                                                                                                                                                                                                              Function 00408A2F Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 004071EC: GetDlgItem.USER32(?,?), ref: 004071F8
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407209: GetDlgItem.USER32(?,?), ref: 00407216
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407209: ShowWindow.USER32(00000000,?), ref: 0040722D
                                                                                                                                                                                                                                                                                              • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00408A77
                                                                                                                                                                                                                                                                                              • SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 00408A97
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B7), ref: 00408AAA
                                                                                                                                                                                                                                                                                              • SetWindowLongW.USER32(00000000,000000FC,Function_00007852), ref: 00408AB8
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AC8), ref: 00408727
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: LoadIconW.USER32(00000000), ref: 0040872A
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetSystemMetrics.USER32(00000032), ref: 0040873E
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetSystemMetrics.USER32(00000031), ref: 00408743
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AC8), ref: 0040874C
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: LoadImageW.USER32(00000000), ref: 0040874F
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: SendMessageW.USER32(?,00000080,00000001,?), ref: 0040876F
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408778
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B2), ref: 00408794
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B2), ref: 0040879E
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetWindowLongW.USER32(?,000000F0), ref: 004087AA
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087B9
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B5), ref: 004087C7
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B5), ref: 004087D5
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: GetWindowLongW.USER32(?,000000F0), ref: 004087E1
                                                                                                                                                                                                                                                                                                • Part of subcall function 004086FE: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087F0
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407BBF: GetDlgItem.USER32(?,000004B6), ref: 00407BCC
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407BBF: SetFocus.USER32(00000000,?,?,00407CB3,000004B6,?), ref: 00407BD3
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3043669009-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1f0e94b95f020d3b8e77b37237e9aadbc50514f1cf521aa7691f1bf8f68bcbb1
                                                                                                                                                                                                                                                                                              • Instruction ID: 89f3b88826d8887572c5d6fe444f9f02d0f5d57ef80b66f4cb10b8e9da8ac73b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f0e94b95f020d3b8e77b37237e9aadbc50514f1cf521aa7691f1bf8f68bcbb1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BA11A975E403146BCB10EBA99C09FDA77FCAB84704F10447FB652E32D1DAB8E9408758
                                                                                                                                                                                                                                                                                              Function 004070CA Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 004070F1
                                                                                                                                                                                                                                                                                              • GetSystemMetrics.USER32(00000031), ref: 00407117
                                                                                                                                                                                                                                                                                              • CreateFontIndirectW.GDI32(?), ref: 00407126
                                                                                                                                                                                                                                                                                              • DeleteObject.GDI32(00000000), ref: 00407155
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1900162674-0
                                                                                                                                                                                                                                                                                              • Opcode ID: ee45daaef24bc28aa4936f7b9027f65fc4e36ca63f23fb62e3441661ca62ae1a
                                                                                                                                                                                                                                                                                              • Instruction ID: 7ca149eb978450d9eaaa00a785ca09fbf38d10ddd3a5f9416087942f21ed5d96
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee45daaef24bc28aa4936f7b9027f65fc4e36ca63f23fb62e3441661ca62ae1a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 601133B5A00205EFDB149F94DC88FEAB7B8EB44300F0580AAED15A7391DB74AE44CB54
                                                                                                                                                                                                                                                                                              Function 00408589 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ScreenToClient.USER32(?,?), ref: 004085C3
                                                                                                                                                                                                                                                                                              • GetClientRect.USER32(?,?), ref: 004085D5
                                                                                                                                                                                                                                                                                              • PtInRect.USER32(?,?,?), ref: 004085E4
                                                                                                                                                                                                                                                                                                • Part of subcall function 00407FEB: KillTimer.USER32(?,00000001,?,004085F9), ref: 00407FF9
                                                                                                                                                                                                                                                                                              • CallNextHookEx.USER32(?,?,?), ref: 00408606
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ClientRect$CallHookKillNextScreenTimer
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3015594791-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 67cc68fca27d81dcad1998da31b7a21cb57a8bde74af4e36de8cdfd47b2d5014
                                                                                                                                                                                                                                                                                              • Instruction ID: a9507084e86a50c26018d12a95ccdb9cd04dbf8e5f515733648f13949fbe8a17
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67cc68fca27d81dcad1998da31b7a21cb57a8bde74af4e36de8cdfd47b2d5014
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B1012931200109EFDB10AFA9EE44EEB7BA5FF44340B04843EF946A62A1DF35E851DB59
                                                                                                                                                                                                                                                                                              Function 00404148 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00403116: GetWindowTextLengthW.USER32(?), ref: 00403127
                                                                                                                                                                                                                                                                                                • Part of subcall function 00403116: GetWindowTextW.USER32(004031A0,00000000,00000001), ref: 00403144
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,00414778,00414780), ref: 00404194
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00414778,00414780), ref: 0040419C
                                                                                                                                                                                                                                                                                              • SetWindowTextW.USER32(?,?), ref: 004041A9
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(?), ref: 004041B4
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@TextWindow$Length
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2308334395-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 2605b28efd450ab0e0b1451baf9b217d640d98c8982da0dc6bf1a84c0e245a29
                                                                                                                                                                                                                                                                                              • Instruction ID: 8203e9935672bf19afbfd2d9b02dfcce5b04130e2821ee87a37bdffe64818393
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2605b28efd450ab0e0b1451baf9b217d640d98c8982da0dc6bf1a84c0e245a29
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 00F0FF72D0410CBACF01BFA1DD46CDE7BB8AE04348F10446AF505B20A1EB75AA948794
                                                                                                                                                                                                                                                                                              Function 00407945 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetObjectW.GDI32(?,0000005C,?), ref: 00407960
                                                                                                                                                                                                                                                                                              • CreateFontIndirectW.GDI32(?), ref: 00407976
                                                                                                                                                                                                                                                                                              • GetDlgItem.USER32(?,000004B5), ref: 0040798A
                                                                                                                                                                                                                                                                                              • SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 00407996
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateFontIndirectItemMessageObjectSend
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2001801573-0
                                                                                                                                                                                                                                                                                              • Opcode ID: cf5f9feb201e3eb52ad9ab8d19ded081f29c03fbfabb12ca70d1e47154dfdd2c
                                                                                                                                                                                                                                                                                              • Instruction ID: 6a17f5e8e35155f57439c70a91428e418c09d7387c40aa3fbc77a88a27bb5ba5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cf5f9feb201e3eb52ad9ab8d19ded081f29c03fbfabb12ca70d1e47154dfdd2c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8DF054B1900704ABE7205BA9DD09FC77FBCAB84B01F048039BA11E21D5DBB4E401CA29
                                                                                                                                                                                                                                                                                              Function 00401DB9 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetParent.USER32(?), ref: 00401DBE
                                                                                                                                                                                                                                                                                              • GetWindowRect.USER32(?,?), ref: 00401DD7
                                                                                                                                                                                                                                                                                              • ScreenToClient.USER32(00000000,?), ref: 00401DE5
                                                                                                                                                                                                                                                                                              • ScreenToClient.USER32(00000000,?), ref: 00401DEC
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ClientScreen$ParentRectWindow
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2099118873-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 9ac7bb66e59a287b07c9635548890c60333ad6437c4a5ad200794121c1393770
                                                                                                                                                                                                                                                                                              • Instruction ID: f8f94db76321b844ec6104e6d5447e13ac28992312c2680a702f521ad6fa1c41
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9ac7bb66e59a287b07c9635548890c60333ad6437c4a5ad200794121c1393770
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CAE086722042166BD7105BE5FC88C8B7FBDEFC5766700447AF94592130C7309C10DA71
                                                                                                                                                                                                                                                                                              Function 004111D9 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 243COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00410B43: ??2@YAPAXI@Z.MSVCRT(0000000C,000000FF,00411309,00415D94,00000001,?,?,00000000), ref: 00410B48
                                                                                                                                                                                                                                                                                              • ??3@YAXPAX@Z.MSVCRT(00000000,00415D94,00000001,?,?,00000000), ref: 0041130A
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040D5B6: ??2@YAPAXI@Z.MSVCRT(?,?,?,?,004102C5,00010000), ref: 0040D5C9
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040D5B6: memmove.MSVCRT(00000000,?,?,?,?,?,004102C5,00010000), ref: 0040D5E3
                                                                                                                                                                                                                                                                                                • Part of subcall function 0040D5B6: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,004102C5,00010000), ref: 0040D5F3
                                                                                                                                                                                                                                                                                              • ??2@YAPAXI@Z.MSVCRT(00000014,00000000,00415D94,00000001,?,?,00000000), ref: 00411342
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??2@$??3@$memmove
                                                                                                                                                                                                                                                                                              • String ID: t]A
                                                                                                                                                                                                                                                                                              • API String ID: 4294387087-2725727105
                                                                                                                                                                                                                                                                                              • Opcode ID: f31868b8816ab1d5768a5aa1898c6c2ac220f134d47644713b6d5cf43657dd11
                                                                                                                                                                                                                                                                                              • Instruction ID: 81c2ab0cc22745a9f4371f108cdfb949ce4a1963edcd174408460c6a5bfcd2f6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f31868b8816ab1d5768a5aa1898c6c2ac220f134d47644713b6d5cf43657dd11
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DEB1D2B1900218DFCB14DF9AC8909DDBBB4BF58348F50813EF919A7261DB38A989CF54
                                                                                                                                                                                                                                                                                              Function 00407ECD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ??3@wsprintf
                                                                                                                                                                                                                                                                                              • String ID: (%d%s)
                                                                                                                                                                                                                                                                                              • API String ID: 3815514257-2087557067
                                                                                                                                                                                                                                                                                              • Opcode ID: d0161d1fbd31c55a70403007823b4b5f32969b85c509a12034915785b45328b1
                                                                                                                                                                                                                                                                                              • Instruction ID: 8a36046f79fd413c4cbdc181e856807dfed79737d16026c8b1b8b17132c7f2e7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0161d1fbd31c55a70403007823b4b5f32969b85c509a12034915785b45328b1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E5F09671800218AFCF11BB55DD46EDEB7B8AF00308F1045BBB512B14E2DAB5A6548A58
                                                                                                                                                                                                                                                                                              Function 004044AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 004044BA
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000C.00000002.2699053734.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699038684.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699077190.0000000000414000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699096981.0000000000418000.00000004.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000C.00000002.2699119160.000000000041B000.00000002.00000001.01000000.00000010.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_12_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Message
                                                                                                                                                                                                                                                                                              • String ID: 7-Zip SFX$Could not allocate memory
                                                                                                                                                                                                                                                                                              • API String ID: 2030045667-3806377612
                                                                                                                                                                                                                                                                                              • Opcode ID: 330f658d4037a0d44fb23f8f268cc4495736feb570957682d21f2dac55989a64
                                                                                                                                                                                                                                                                                              • Instruction ID: 752229e11c10a15970a66ffa1679a9ec66b8eca087eb26f5146150477e14d876
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 330f658d4037a0d44fb23f8f268cc4495736feb570957682d21f2dac55989a64
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BBB011B03C0B0CBAE20003A08C0BFC020A00BC8F83F220822BA28EE0C0EAC800E0A00C

                                                                                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                                                                                              Execution Coverage:4.6%
                                                                                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                                              Signature Coverage:0.7%
                                                                                                                                                                                                                                                                                              Total number of Nodes:2000
                                                                                                                                                                                                                                                                                              Total number of Limit Nodes:11
                                                                                                                                                                                                                                                                                              execution_graph 66586 201c50 66589 337b93 66586->66589 66592 337cba 66589->66592 66593 337cda 66592->66593 66594 337cc8 66592->66594 66604 337df8 66593->66604 66620 32a489 GetModuleHandleW 66594->66620 66597 337ccd 66597->66593 66621 337c12 GetModuleHandleExW 66597->66621 66599 201c5a 66605 337e04 CallCatchBlock 66604->66605 66627 347ce1 EnterCriticalSection 66605->66627 66607 337e0e 66628 337d1e 66607->66628 66609 337e1b 66632 337e39 66609->66632 66612 337c65 66637 3497fb GetPEB 66612->66637 66615 337c94 66618 337c12 CallCatchBlock 3 API calls 66615->66618 66616 337c74 GetPEB 66616->66615 66617 337c84 GetCurrentProcess TerminateProcess 66616->66617 66617->66615 66619 337c9c ExitProcess 66618->66619 66620->66597 66622 337c31 GetProcAddress 66621->66622 66623 337c54 66621->66623 66624 337c46 66622->66624 66625 337c63 66623->66625 66626 337c5a FreeLibrary 66623->66626 66624->66623 66625->66593 66626->66625 66627->66607 66629 337d2a CallCatchBlock 66628->66629 66630 337d8b CallCatchBlock 66629->66630 66635 33a0f0 EnterCriticalSection LeaveCriticalSection CallCatchBlock 66629->66635 66630->66609 66636 347cf8 LeaveCriticalSection 66632->66636 66634 337d0d 66634->66599 66634->66612 66635->66630 66636->66634 66638 337c6f 66637->66638 66639 349815 66637->66639 66638->66615 66638->66616 66641 3478ac 5 API calls _unexpected 66639->66641 66641->66638 66642 256360 66643 25637c 66642->66643 66644 25636e 66642->66644 66646 258370 GetHandleVerifier 66644->66646 66647 258383 66646->66647 66647->66643 66648 1f1000 66696 233f70 66648->66696 66650 1f1027 66705 1f59e4 66650->66705 66653 1f104f _strlen 66710 1f5a43 66653->66710 66654 1f103e 66936 1f5a0e 472 API calls 66654->66936 66656 1f1045 66937 3294aa 66656->66937 66661 1f1319 66662 1f107f 66722 25a1d0 66662->66722 66666 1f10f5 66735 240ee0 66666->66735 66670 1f113b 66788 23ba00 66670->66788 66672 1f117f 66673 1f11f5 66672->66673 66816 23bec0 66672->66816 66896 249df0 66673->66896 66679 1f11b4 66839 235860 66679->66839 66684 1f11d9 66860 23c2a0 66684->66860 66697 233f83 66696->66697 66698 234016 66696->66698 66699 3293de 3 API calls 66697->66699 66698->66650 66700 233f8a 66699->66700 66701 3293de 3 API calls 66700->66701 66702 233fa3 GetCommandLineW 66701->66702 66703 233ff3 66702->66703 66944 234020 66703->66944 67075 200acc 66705->67075 66708 1f1037 66708->66653 66708->66654 67105 258410 66710->67105 66715 2581c0 66716 258215 CoInitializeEx 66715->66716 66717 2581e3 66715->66717 66716->66662 68989 32940e RaiseException EnterCriticalSection LeaveCriticalSection 66717->68989 66719 2581ef 66720 258201 66719->66720 68990 28e940 6 API calls _ValidateLocalCookies 66719->68990 66720->66716 66723 25a202 66722->66723 66727 25a255 66722->66727 66724 25a278 FileTimeToSystemTime 66723->66724 66725 25a228 FileTimeToSystemTime 66723->66725 66724->66727 66726 25a243 SystemTimeToTzSpecificLocalTime 66725->66726 66725->66727 66726->66727 66728 3294aa _ValidateLocalCookies 5 API calls 66727->66728 66729 1f10ce 66728->66729 66730 2487e0 66729->66730 68991 248840 66730->68991 66733 3294aa _ValidateLocalCookies 5 API calls 66734 248829 66733->66734 66734->66666 66763 240f17 66735->66763 66736 3294e7 __Init_thread_header 6 API calls 66736->66763 66737 240f1c 69052 2533c0 180 API calls 2 library calls 66737->69052 66738 240f3a TryAcquireSRWLockExclusive 66738->66763 66740 240f24 66741 3294aa _ValidateLocalCookies 5 API calls 66740->66741 66744 1f1118 66741->66744 66742 3293de 3 API calls 66742->66763 66743 241071 ReleaseSRWLockExclusive 66743->66763 66766 238b80 66744->66766 66745 32955d __Init_thread_footer 5 API calls 66745->66763 66746 241152 ReleaseSRWLockExclusive 66751 24115d 66746->66751 66747 239e40 35 API calls 66747->66763 66748 2411e7 66749 24121f 66748->66749 69055 241520 37 API calls __floor_pentium4 66748->69055 66750 237db0 23 API calls 66749->66750 66754 24122b ReleaseSRWLockExclusive 66750->66754 66756 3294aa _ValidateLocalCookies 5 API calls 66751->66756 66752 237db0 23 API calls 66757 24110b TryAcquireSRWLockExclusive 66752->66757 66754->66751 66756->66744 66759 24111d 66757->66759 66757->66763 66758 241213 66760 237db0 23 API calls 66758->66760 66759->66746 69054 241520 37 API calls __floor_pentium4 66759->69054 66760->66749 66762 241143 66764 237db0 23 API calls 66762->66764 66763->66736 66763->66737 66763->66738 66763->66742 66763->66743 66763->66745 66763->66746 66763->66747 66763->66748 66763->66749 66763->66751 66763->66752 69053 251500 188 API calls 2 library calls 66763->69053 66765 24114f 66764->66765 66765->66746 66768 238bcf 66766->66768 66770 238c12 66768->66770 66771 238e4b 66768->66771 66781 238c17 __fread_nolock 66768->66781 66774 238e54 66770->66774 66775 238c4a 66770->66775 66770->66781 69060 230494 23 API calls 66771->69060 66773 238ce0 66778 237cd0 35 API calls 66773->66778 66779 33d9b4 _unexpected 34 API calls 66774->66779 66777 3293de 3 API calls 66775->66777 66776 238cc7 66780 237cd0 35 API calls 66776->66780 66777->66781 66787 238d16 66778->66787 66782 238e59 66779->66782 66783 238cd0 66780->66783 69056 2321f0 66781->69056 66784 3294aa _ValidateLocalCookies 5 API calls 66783->66784 66785 238e3f 66784->66785 66785->66670 66786 231878 23 API calls 66786->66783 66787->66786 66789 23ba18 66788->66789 69061 234730 66789->69061 66792 23ba36 66793 23bb9b 66792->66793 66795 3293de 3 API calls 66792->66795 66815 23babe 66792->66815 66794 234730 5 API calls 66794->66792 66796 23ba5c _strlen 66795->66796 66803 2347a0 23 API calls 66796->66803 66797 23bb85 66800 3294aa _ValidateLocalCookies 5 API calls 66797->66800 66798 23bb2f 66802 23bb40 66798->66802 66806 3293de 3 API calls 66798->66806 66799 23baed CloseHandle 66801 23bb08 66799->66801 66799->66802 66804 23bb91 66800->66804 66801->66798 66807 231bbc 23 API calls 66802->66807 66805 23ba87 _strlen 66803->66805 66804->66672 66812 2347a0 23 API calls 66805->66812 66806->66802 66808 23bb66 66807->66808 66809 23bb80 66808->66809 66810 23bb79 DeleteFileW 66808->66810 69065 23bba0 66809->69065 66810->66809 66813 23baad 66812->66813 69102 276090 44 API calls _ValidateLocalCookies 66813->69102 66815->66797 66815->66798 66815->66799 69108 21b046 66816->69108 66821 2766b0 13 API calls 66822 23bf49 66821->66822 69114 23bf60 66822->69114 66825 1f1741 66826 1f181d 66825->66826 66827 1f1771 66825->66827 66828 1f19a0 121 API calls 66826->66828 66829 219db0 121 API calls 66827->66829 66830 1f177e 66827->66830 66831 1f1825 66828->66831 66829->66830 66836 22bb88 10 API calls 66830->66836 66838 1f17ad 66830->66838 66833 3294aa _ValidateLocalCookies 5 API calls 66831->66833 66835 1f182f 66833->66835 66834 1f1800 66834->66826 69270 21afea 121 API calls 66834->69270 66835->66679 66836->66838 69269 1f1840 8 API calls 2 library calls 66838->69269 66840 2313a0 23 API calls 66839->66840 66841 235896 66840->66841 69271 235960 66841->69271 66843 2358a2 69277 235c00 66843->69277 66846 235938 66848 3294aa _ValidateLocalCookies 5 API calls 66846->66848 66850 1f11c9 66848->66850 66849 235921 66851 231878 23 API calls 66849->66851 66852 23cb30 66850->66852 66851->66846 66853 23cb51 66852->66853 66857 23cb6f 66852->66857 69293 2492e0 23 API calls 66853->69293 66854 1f1741 121 API calls 66856 23cbbf 66854->66856 66858 3294aa _ValidateLocalCookies 5 API calls 66856->66858 66857->66854 66859 23cbe0 66858->66859 66859->66684 66861 23c2ef 66860->66861 66862 22bb88 10 API calls 66861->66862 66863 23c335 66862->66863 69294 21ab60 66863->69294 66866 219db0 121 API calls 66867 23c35d 66866->66867 66868 1f5604 23 API calls 66867->66868 66870 23c38a 66868->66870 66869 23c82d 66870->66869 66871 3293de 3 API calls 66870->66871 66878 23c397 66870->66878 66872 23c6d0 66871->66872 69321 2792a0 50 API calls 2 library calls 66872->69321 66875 23c439 69312 3419a3 66875->69312 66876 23c6ec 69322 211c60 GetCurrentThreadId 66876->69322 66881 23c4d2 __fread_nolock 66878->66881 69302 3428cd 66878->69302 66880 23c44c 66880->66881 66882 23c4a9 66880->66882 66886 23c4c9 _strlen 66880->66886 66883 3294e7 __Init_thread_header 6 API calls 66881->66883 66888 23c532 66881->66888 69320 278870 121 API calls __fread_nolock 66882->69320 66887 23c7c7 66883->66887 66884 2766e0 12 API calls 66893 23c64a 66884->66893 66886->66869 66886->66884 66887->66888 66889 32955d __Init_thread_footer 5 API calls 66887->66889 66888->66869 66888->66886 66890 3294e7 __Init_thread_header 6 API calls 66888->66890 66889->66888 66891 23c7ff 66890->66891 66891->66886 66892 32955d __Init_thread_footer 5 API calls 66891->66892 66892->66886 66894 3294aa _ValidateLocalCookies 5 API calls 66893->66894 66895 23c69a 66894->66895 66895->66673 69328 283920 66896->69328 66898 249e14 69346 249e40 66898->69346 66936->66656 66938 3294b3 66937->66938 66939 3294b5 IsProcessorFeaturePresent 66937->66939 66938->66661 66941 32a343 66939->66941 69525 32a428 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 66941->69525 66943 32a426 66943->66661 66967 246f20 66944->66967 66947 234057 LoadLibraryExW 66948 23409a CommandLineToArgvW 66947->66948 66949 23407f GetProcAddress 66947->66949 66955 2340a5 66948->66955 66952 23408f 66949->66952 66950 3294aa _ValidateLocalCookies 5 API calls 66951 234225 66950->66951 66951->66698 66952->66955 66953 2341a8 66971 233c40 66953->66971 66954 23423b 66955->66953 66955->66954 66957 3293de 3 API calls 66955->66957 66959 2340eb __fread_nolock 66957->66959 66959->66953 66962 23422f 66959->66962 66964 234236 66959->66964 66966 3293de 3 API calls 66959->66966 66960 2341d4 FreeLibrary 66961 2341db 66960->66961 66961->66950 66982 230494 23 API calls 66962->66982 66983 33d9b4 66964->66983 66966->66959 66968 246f4e 66967->66968 66969 3294aa _ValidateLocalCookies 5 API calls 66968->66969 66970 234049 66969->66970 66970->66947 66970->66961 66972 3293de 3 API calls 66971->66972 66973 233c5c 66972->66973 66976 233d2a 66973->66976 67028 237cd0 66973->67028 66994 233a80 66976->66994 66977 233d3f 67009 234270 66977->67009 66979 233d4e 66980 3294aa _ValidateLocalCookies 5 API calls 66979->66980 66981 233d58 LocalFree 66980->66981 66981->66960 66981->66961 67056 3436fc 66983->67056 66986 33d9c4 66987 33d9ce IsProcessorFeaturePresent 66986->66987 66992 33d9ed 66986->66992 66989 33d9da 66987->66989 67063 33be76 8 API calls 3 library calls 66989->67063 67059 337ba9 66992->67059 66995 233aa5 66994->66995 66996 246f20 5 API calls 66995->66996 66997 233ab8 66996->66997 66998 233bc1 66997->66998 66999 233aeb 66997->66999 67001 233af0 __fread_nolock 66997->67001 67041 230494 23 API calls 66998->67041 66999->67001 67002 233b27 66999->67002 67003 233bca 66999->67003 67004 3294aa _ValidateLocalCookies 5 API calls 67001->67004 67005 3293de 3 API calls 67002->67005 67006 33d9b4 _unexpected 34 API calls 67003->67006 67007 233bb7 67004->67007 67005->67001 67008 233bcf 67006->67008 67007->66977 67010 234592 67009->67010 67026 2342a5 __fread_nolock 67009->67026 67011 3294aa _ValidateLocalCookies 5 API calls 67010->67011 67012 234698 67011->67012 67012->66979 67013 246f20 5 API calls 67013->67026 67014 2346a2 67052 230494 23 API calls 67014->67052 67016 2346ab 67017 33d9b4 _unexpected 34 API calls 67016->67017 67017->67016 67018 3293de 3 API calls 67018->67026 67021 23467c 67021->66979 67022 2313a0 23 API calls 67022->67026 67026->67010 67026->67013 67026->67014 67026->67016 67026->67018 67026->67021 67026->67022 67042 23225a 67026->67042 67047 235220 23 API calls 2 library calls 67026->67047 67048 2354e0 5 API calls 2 library calls 67026->67048 67049 2356a0 35 API calls 3 library calls 67026->67049 67050 2492e0 23 API calls 67026->67050 67051 211878 35 API calls _ValidateLocalCookies 67026->67051 67029 237cdf 67028->67029 67033 237d04 __fread_nolock 67028->67033 67030 237d81 67029->67030 67031 237cff 67029->67031 67055 230494 23 API calls 67030->67055 67031->67033 67034 237d88 67031->67034 67035 237d29 67031->67035 67036 237d78 67033->67036 67054 231dd6 23 API calls CatchIt 67033->67054 67037 33d9b4 _unexpected 34 API calls 67034->67037 67038 3293de 3 API calls 67035->67038 67036->66976 67040 237d8d 67037->67040 67038->67033 67043 23226b 67042->67043 67046 23227e 67043->67046 67053 2304a2 23 API calls 67043->67053 67046->67026 67047->67026 67048->67026 67049->67026 67050->67026 67051->67026 67054->67036 67064 343c1a 67056->67064 67060 337cba CallCatchBlock 16 API calls 67059->67060 67061 337bba 67060->67061 67061->66954 67062 3438e2 34 API calls 4 library calls 67062->66986 67063->66992 67065 343c26 CallCatchBlock 67064->67065 67070 347ce1 EnterCriticalSection 67065->67070 67067 343c34 67071 343c72 67067->67071 67070->67067 67074 347cf8 LeaveCriticalSection 67071->67074 67073 33d9b9 67073->66986 67073->67062 67074->67073 67083 2347a0 67075->67083 67077 200afa _strlen 67078 200b2c 67077->67078 67091 23130a 23 API calls _strlen 67077->67091 67080 3294aa _ValidateLocalCookies 5 API calls 67078->67080 67081 1f59f1 67080->67081 67081->66708 67082 200dac 23 API calls 2 library calls 67081->67082 67082->66708 67084 2347e2 67083->67084 67086 2347fa 67084->67086 67092 2313a0 67084->67092 67087 23485b 67086->67087 67102 2492e0 23 API calls 67086->67102 67089 3294aa _ValidateLocalCookies 5 API calls 67087->67089 67090 234896 67089->67090 67090->67077 67091->67078 67093 2313cc 67092->67093 67094 2313bc __fread_nolock 67092->67094 67095 231433 67093->67095 67096 2313d7 67093->67096 67094->67086 67103 230494 23 API calls 67095->67103 67096->67094 67098 23143a 67096->67098 67099 2313f4 67096->67099 67104 22ee4e 23 API calls 2 library calls 67098->67104 67100 3293de 3 API calls 67099->67100 67100->67094 67102->67087 67106 25841c 67105->67106 67251 343723 67106->67251 67109 218004 67110 218023 67109->67110 67111 218a03 67110->67111 67114 21804c 67110->67114 67115 2180e5 67110->67115 67112 3294aa _ValidateLocalCookies 5 API calls 67111->67112 67113 1f1064 67112->67113 67113->66715 67142 2180f6 67114->67142 67331 2346b0 35 API calls 67114->67331 67436 2346b0 35 API calls 67115->67436 67118 218072 67332 1f3696 67118->67332 67123 21808f 67426 230aa2 67123->67426 67126 21809b 67430 238610 67126->67430 67130 218413 67440 2611b0 121 API calls 67130->67440 67131 2183e2 67131->67130 67133 3294e7 __Init_thread_header 6 API calls 67131->67133 67139 218a60 67133->67139 67135 218a20 67135->67131 67454 32955d EnterCriticalSection LeaveCriticalSection 67135->67454 67137 2181c3 67298 261148 67137->67298 67138 218182 _strlen 67138->67137 67144 230c44 23 API calls 67138->67144 67139->67130 67141 32955d __Init_thread_footer 5 API calls 67139->67141 67140 21841d 67143 218474 67140->67143 67147 3294e7 __Init_thread_header 6 API calls 67140->67147 67141->67130 67279 218d9c 67142->67279 67146 261148 50 API calls 67143->67146 67144->67137 67149 21847e 67146->67149 67150 218aa0 67147->67150 67148 2181ee 67301 230c44 67148->67301 67155 3294e7 __Init_thread_header 6 API calls 67149->67155 67161 2184d5 _strlen 67149->67161 67150->67143 67152 32955d __Init_thread_footer 5 API calls 67150->67152 67152->67143 67159 218ae0 67155->67159 67157 215d30 3 API calls 67158 218270 _strlen 67157->67158 67309 215d88 67158->67309 67160 32955d __Init_thread_footer 5 API calls 67159->67160 67159->67161 67160->67161 67162 21851e 67161->67162 67164 3294e7 __Init_thread_header 6 API calls 67161->67164 67441 1f5886 121 API calls _ValidateLocalCookies 67162->67441 67166 218b20 67164->67166 67166->67162 67168 32955d __Init_thread_footer 5 API calls 67166->67168 67167 218528 67170 21857f 67167->67170 67173 3294e7 __Init_thread_header 6 API calls 67167->67173 67168->67162 67169 218289 _strlen 67171 2347a0 23 API calls 67169->67171 67442 1f58db 121 API calls 67170->67442 67174 2182c7 67171->67174 67177 218b60 67173->67177 67175 218d9c 12 API calls 67174->67175 67176 2182cc 67175->67176 67315 2151b2 67176->67315 67177->67170 67178 32955d __Init_thread_footer 5 API calls 67177->67178 67178->67170 67180 2182df 67322 270180 67180->67322 67181 218589 67443 2346b0 35 API calls 67181->67443 67184 2185db 67186 2185fc 67184->67186 67189 3294e7 __Init_thread_header 6 API calls 67184->67189 67185 2182f4 67327 270322 67185->67327 67444 1f5916 35 API calls _ValidateLocalCookies 67186->67444 67196 218ba0 67189->67196 67190 21830e 67191 218328 67190->67191 67192 21831c 67190->67192 67194 1f3696 121 API calls 67191->67194 67193 2151b2 23 API calls 67192->67193 67195 218326 67193->67195 67194->67195 67438 270607 5 API calls _strlen 67195->67438 67196->67186 67199 32955d __Init_thread_footer 5 API calls 67196->67199 67198 218602 _strlen 67201 218649 67198->67201 67202 3294e7 __Init_thread_header 6 API calls 67198->67202 67199->67186 67200 21833c 67439 26ac9c 8 API calls _ValidateLocalCookies 67200->67439 67445 243850 23 API calls 2 library calls 67201->67445 67205 218be0 67202->67205 67205->67201 67207 32955d __Init_thread_footer 5 API calls 67205->67207 67206 218357 _strlen 67206->67131 67449 3294e7 EnterCriticalSection 67206->67449 67207->67201 67208 218659 67446 253040 180 API calls _ValidateLocalCookies 67208->67446 67210 2186b7 67213 3294e7 __Init_thread_header 6 API calls 67210->67213 67218 2186df __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 67210->67218 67222 218702 67210->67222 67211 218759 GetCurrentProcess 67448 258b40 6 API calls _ValidateLocalCookies 67211->67448 67212 3294e7 __Init_thread_header 6 API calls 67215 218c20 67212->67215 67221 218d26 67213->67221 67215->67211 67219 218c30 67215->67219 67216 218765 67217 1f3696 121 API calls 67216->67217 67225 21878e 67217->67225 67447 243cc0 23 API calls 3 library calls 67218->67447 67223 32955d __Init_thread_footer 5 API calls 67219->67223 67221->67218 67224 32955d __Init_thread_footer 5 API calls 67221->67224 67222->67211 67222->67212 67226 218c4e 67223->67226 67224->67218 67227 215d30 3 API calls 67225->67227 67226->67211 67228 2187db _strlen 67227->67228 67230 21882b 67228->67230 67231 3294e7 __Init_thread_header 6 API calls 67228->67231 67229 215d30 3 API calls 67234 218866 _strlen 67229->67234 67230->67229 67232 218c60 67231->67232 67232->67230 67233 32955d __Init_thread_footer 5 API calls 67232->67233 67233->67230 67235 218920 67234->67235 67236 21889a 67234->67236 67237 215d30 3 API calls 67235->67237 67238 3294e7 __Init_thread_header 6 API calls 67236->67238 67239 2188bb 67236->67239 67245 21893a _strlen 67237->67245 67240 218ca3 67238->67240 67241 3294e7 __Init_thread_header 6 API calls 67239->67241 67248 2188fd _strlen 67239->67248 67240->67239 67242 32955d __Init_thread_footer 5 API calls 67240->67242 67243 218ce6 67241->67243 67242->67239 67244 32955d __Init_thread_footer 5 API calls 67243->67244 67243->67248 67244->67248 67246 3294e7 __Init_thread_header 6 API calls 67245->67246 67245->67248 67247 218d66 67246->67247 67247->67248 67249 32955d __Init_thread_footer 5 API calls 67247->67249 67248->67111 67249->67248 67252 34372f CallCatchBlock 67251->67252 67253 343809 67252->67253 67258 343774 67252->67258 67266 343783 __fread_nolock CallCatchBlock 67252->67266 67274 347ce1 EnterCriticalSection 67253->67274 67256 34381d 67257 343834 SetConsoleCtrlHandler 67256->67257 67262 343845 _unexpected CallCatchBlock 67256->67262 67259 34384e 67257->67259 67257->67262 67258->67266 67269 346fb1 11 API calls 2 library calls 67258->67269 67275 33a805 11 API calls __dosmaperr 67259->67275 67276 3438c0 LeaveCriticalSection CallCatchBlock 67262->67276 67263 34378e 67263->67266 67270 258c30 67263->67270 67264 343853 GetLastError 67264->67262 67268 1f5a53 67266->67268 67277 343b3f 11 API calls __dosmaperr 67266->67277 67268->67109 67269->67263 67272 258c40 67270->67272 67271 258c65 67271->67266 67272->67271 67278 28fa70 EnterCriticalSection LeaveCriticalSection ___std_exception_copy 67272->67278 67274->67256 67275->67264 67276->67266 67277->67268 67278->67272 67280 218da6 67279->67280 67286 218158 67280->67286 67459 23b640 7 API calls _ValidateLocalCookies 67280->67459 67282 218dbf 67283 3293de 3 API calls 67282->67283 67282->67286 67284 218dcd 67283->67284 67460 23b700 10 API calls 67284->67460 67287 219030 67286->67287 67288 219057 67287->67288 67461 21724c 67288->67461 67291 21906f 67293 3294aa _ValidateLocalCookies 5 API calls 67291->67293 67294 218160 67293->67294 67294->67206 67295 215d30 67294->67295 67894 2373d0 67295->67894 67897 248590 67298->67897 67302 230c54 _strlen 67301->67302 67968 230632 67302->67968 67304 21825d 67305 23060c 67304->67305 67306 230616 67305->67306 67308 218269 67305->67308 67307 230632 23 API calls 67306->67307 67307->67308 67308->67157 67310 215dbc 67309->67310 67312 215de9 67310->67312 67973 23130a 23 API calls _strlen 67310->67973 67313 3294aa _ValidateLocalCookies 5 API calls 67312->67313 67314 215e65 67313->67314 67314->67169 67316 2151c2 67315->67316 67317 2151d8 __fread_nolock 67315->67317 67318 2151d3 67316->67318 67319 21522f 67316->67319 67317->67180 67318->67317 67321 3293de 3 API calls 67318->67321 67974 230494 23 API calls 67319->67974 67321->67317 67975 26ff91 67322->67975 67324 2701bf 67325 3294aa _ValidateLocalCookies 5 API calls 67324->67325 67326 2701d3 67325->67326 67326->67185 67328 27032d 67327->67328 67329 3293de 3 API calls 67328->67329 67330 27033a __fread_nolock 67329->67330 67330->67190 67331->67118 67333 1f36b2 _strlen 67332->67333 67334 1f36ba 67333->67334 67335 1f3713 67333->67335 67337 3293de 3 API calls 67334->67337 67340 1f36bf __fread_nolock 67334->67340 68983 230494 23 API calls 67335->68983 67337->67340 67340->67123 67427 230ab2 _strlen 67426->67427 67428 230920 23 API calls 67427->67428 67429 230abe 67428->67429 67429->67126 67431 23863a 67430->67431 67432 237cd0 35 API calls 67431->67432 67433 238648 67432->67433 67434 2180d2 67433->67434 68984 231bbc 67433->68984 67437 239d80 35 API calls _ValidateLocalCookies 67434->67437 67436->67142 67437->67142 67438->67200 67439->67206 67440->67140 67441->67167 67442->67181 67443->67184 67444->67198 67445->67208 67446->67210 67447->67222 67448->67216 67451 3294fb 67449->67451 67450 329500 LeaveCriticalSection 67450->67135 67451->67450 68988 3295a7 SleepConditionVariableCS LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 67451->68988 67455 3295f5 67454->67455 67456 329600 WakeAllConditionVariable 67455->67456 67457 329611 SetEvent ResetEvent 67455->67457 67456->67131 67457->67131 67459->67282 67460->67286 67462 215d30 3 API calls 67461->67462 67464 217277 _strlen 67462->67464 67463 217300 67485 217387 67463->67485 67464->67463 67512 23a1d0 35 API calls _ValidateLocalCookies 67464->67512 67466 2172c8 67513 217201 67466->67513 67472 2172f5 67478 3294aa _ValidateLocalCookies 5 API calls 67472->67478 67473 2172d7 67473->67463 67475 2172ed 67473->67475 67474 217345 67474->67472 67477 237db0 23 API calls 67474->67477 67521 237db0 67475->67521 67477->67472 67480 21737d 67478->67480 67480->67291 67481 231510 67480->67481 67482 23151a 67481->67482 67484 23152e 67481->67484 67890 231536 67482->67890 67484->67291 67486 21740c 67485->67486 67488 2173bb 67485->67488 67487 3294e7 __Init_thread_header 6 API calls 67486->67487 67493 217416 67487->67493 67490 238b80 35 API calls 67488->67490 67492 2173e4 67488->67492 67489 3294aa _ValidateLocalCookies 5 API calls 67491 21732b 67489->67491 67490->67492 67491->67472 67503 2524e0 67491->67503 67492->67489 67493->67488 67525 217170 67493->67525 67498 21744e 67539 3299dd EnterCriticalSection LeaveCriticalSection 67498->67539 67499 217201 208 API calls 67499->67498 67501 217493 67502 32955d __Init_thread_footer 5 API calls 67501->67502 67502->67488 67504 252537 67503->67504 67746 24a440 67504->67746 67510 3294aa _ValidateLocalCookies 5 API calls 67511 217338 67510->67511 67511->67474 67524 23a700 198 API calls 67511->67524 67512->67466 67514 217212 67513->67514 67515 2524e0 180 API calls 67514->67515 67520 21723a 67514->67520 67516 21721f 67515->67516 67517 21722c 67516->67517 67888 23a700 198 API calls 67516->67888 67517->67520 67889 251500 188 API calls 2 library calls 67517->67889 67520->67473 67522 231510 23 API calls 67521->67522 67523 237dbe 67522->67523 67523->67472 67524->67474 67526 2171a1 _strlen 67525->67526 67540 2348b0 67526->67540 67529 217201 208 API calls 67530 2171bd 67529->67530 67531 3294aa _ValidateLocalCookies 5 API calls 67530->67531 67532 2171f7 67531->67532 67532->67498 67533 2174d0 67532->67533 67534 2174e1 67533->67534 67535 2174e6 67533->67535 67548 1f5a70 67534->67548 67560 1f75b0 67535->67560 67537 217461 67537->67498 67537->67499 67539->67501 67541 2348dc 67540->67541 67542 2348f1 67541->67542 67543 2313a0 23 API calls 67541->67543 67544 237cd0 35 API calls 67542->67544 67543->67542 67546 234931 67544->67546 67545 3294aa _ValidateLocalCookies 5 API calls 67547 2171b4 67545->67547 67546->67545 67547->67529 67549 1f5ab3 67548->67549 67558 1f5a9e 67548->67558 67551 3294e7 __Init_thread_header 6 API calls 67549->67551 67550 3294aa _ValidateLocalCookies 5 API calls 67552 1f5aa8 67550->67552 67553 1f5abd 67551->67553 67552->67535 67554 3293de 3 API calls 67553->67554 67553->67558 67555 1f5ad0 67554->67555 67578 1f5b20 67555->67578 67557 32955d __Init_thread_footer 5 API calls 67557->67558 67558->67550 67559 1f5aed 67559->67557 67641 1f6470 67560->67641 67562 1f75c1 67563 1f75ed 67562->67563 67564 1f7675 67562->67564 67566 1f767c 67563->67566 67567 1f760a 67563->67567 67571 1f75f7 __fread_nolock 67563->67571 67691 230494 23 API calls 67564->67691 67568 33d9b4 _unexpected 34 API calls 67566->67568 67569 3293de 3 API calls 67567->67569 67573 1f7681 67568->67573 67569->67571 67570 1f7669 67570->67537 67571->67570 67687 231878 67571->67687 67577 1f76da 67573->67577 67653 20fbfa 67573->67653 67574 3294aa _ValidateLocalCookies 5 API calls 67576 1f7714 67574->67576 67576->67537 67577->67574 67583 1f5d00 67578->67583 67581 3294aa _ValidateLocalCookies 5 API calls 67582 1f5b53 67581->67582 67582->67559 67584 1f5d39 67583->67584 67585 240ee0 194 API calls 67584->67585 67587 1f5d6b 67585->67587 67589 238b80 35 API calls 67587->67589 67595 1f5dc2 67587->67595 67590 1f5db5 67589->67590 67603 252320 67590->67603 67591 3294aa _ValidateLocalCookies 5 API calls 67593 1f5b49 67591->67593 67593->67581 67612 1f5e80 67595->67612 67596 238610 35 API calls 67597 1f5dd2 67596->67597 67598 238b80 35 API calls 67597->67598 67599 1f5e06 67598->67599 67600 252320 180 API calls 67599->67600 67601 1f5e0c 67600->67601 67601->67595 67602 238610 35 API calls 67601->67602 67602->67595 67604 252377 67603->67604 67605 24a440 177 API calls 67604->67605 67607 252388 GetFileAttributesW 67605->67607 67608 24a4b0 169 API calls 67607->67608 67609 2523a4 67608->67609 67610 3294aa _ValidateLocalCookies 5 API calls 67609->67610 67611 1f5dbb 67610->67611 67611->67595 67611->67596 67613 3293de RaiseException EnterCriticalSection LeaveCriticalSection 67612->67613 67614 1f5e9c 67613->67614 67640 201ea0 207 API calls 67614->67640 67615 1f5ec4 67616 1f6280 IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 67615->67616 67617 1f5ecb 67616->67617 67618 2611b0 121 API calls 67617->67618 67619 1f5ed4 67618->67619 67620 249420 35 API calls 67619->67620 67621 1f5ef0 _strlen 67620->67621 67622 249420 35 API calls 67621->67622 67623 1f5f16 67622->67623 67624 231a38 23 API calls 67623->67624 67625 1f5f25 67624->67625 67626 231878 23 API calls 67625->67626 67627 1f5f67 _strlen 67626->67627 67628 249420 35 API calls 67627->67628 67629 1f608a 67628->67629 67630 2611b0 121 API calls 67629->67630 67639 1f616a 67629->67639 67632 1f6100 67630->67632 67631 231a38 23 API calls 67633 1f6193 67631->67633 67636 249420 35 API calls 67632->67636 67634 3294aa _ValidateLocalCookies 5 API calls 67633->67634 67635 1f5e4f 67634->67635 67635->67591 67637 1f611c 67636->67637 67638 231878 23 API calls 67637->67638 67638->67639 67639->67631 67640->67615 67642 1f657c 67641->67642 67645 1f6497 67641->67645 67643 3294aa _ValidateLocalCookies 5 API calls 67642->67643 67644 1f661f 67643->67644 67644->67562 67646 238b80 35 API calls 67645->67646 67647 1f64f7 67646->67647 67692 23a590 67647->67692 67649 1f6526 67649->67642 67702 202ea0 121 API calls _ValidateLocalCookies 67649->67702 67651 1f6559 67651->67642 67703 20238c 23 API calls 67651->67703 67654 20fc28 67653->67654 67655 20fc3c 67653->67655 67656 238b80 35 API calls 67654->67656 67657 20fc8a 67655->67657 67658 20fc5b 67655->67658 67656->67655 67659 20fc92 67657->67659 67660 20fcb5 67657->67660 67661 238b80 35 API calls 67658->67661 67731 249420 35 API calls _unexpected 67659->67731 67662 240ee0 194 API calls 67660->67662 67678 20fc6c 67661->67678 67665 20fcd0 67662->67665 67664 3294aa _ValidateLocalCookies 5 API calls 67667 20fc80 67664->67667 67668 1f3696 121 API calls 67665->67668 67686 20fdf3 67665->67686 67666 20fe38 _strlen 67732 249420 35 API calls _unexpected 67666->67732 67667->67577 67670 20fcf3 _strlen 67668->67670 67726 247bc0 23 API calls _ValidateLocalCookies 67670->67726 67673 20ff80 67679 20febc 67673->67679 67734 231ea8 23 API calls CatchIt 67673->67734 67674 237cd0 35 API calls 67674->67678 67675 20fd1f _strlen 67727 247bc0 23 API calls _ValidateLocalCookies 67675->67727 67678->67664 67679->67674 67679->67678 67680 20fd4a 67728 20f9f0 121 API calls 67680->67728 67682 20fd5a 67729 247bc0 23 API calls _ValidateLocalCookies 67682->67729 67684 20fd7d 67730 239d80 35 API calls _ValidateLocalCookies 67684->67730 67686->67679 67733 20f8e0 24 API calls 2 library calls 67686->67733 67688 23188c 67687->67688 67690 2318bf __fread_nolock 67688->67690 67735 23190e 67688->67735 67690->67570 67693 23a5a0 67692->67693 67704 239e40 67693->67704 67696 23a5ee 67696->67649 67700 23a5e3 67725 341850 71 API calls 4 library calls 67700->67725 67702->67651 67703->67642 67705 239e5f 67704->67705 67706 237fc0 35 API calls 67705->67706 67709 239e8a 67705->67709 67706->67709 67707 3294aa _ValidateLocalCookies 5 API calls 67708 23a0f7 67707->67708 67708->67696 67710 253180 67708->67710 67709->67707 67711 2531d6 67710->67711 67712 24a440 177 API calls 67711->67712 67713 2531e5 _strlen 67712->67713 67714 248e60 23 API calls 67713->67714 67715 253215 67714->67715 67716 231cfa 23 API calls 67715->67716 67717 253244 67716->67717 67718 3403cc 92 API calls 67717->67718 67719 25325f 67718->67719 67720 24a4b0 169 API calls 67719->67720 67721 25327f 67720->67721 67722 3294aa _ValidateLocalCookies 5 API calls 67721->67722 67723 23a5d1 67722->67723 67723->67696 67724 23a330 189 API calls 3 library calls 67723->67724 67724->67700 67725->67696 67726->67675 67727->67680 67728->67682 67729->67684 67730->67686 67731->67666 67732->67686 67733->67673 67734->67679 67736 231a29 67735->67736 67740 23192c 67735->67740 67744 230494 23 API calls 67736->67744 67738 231a2e 67745 22ee4e 23 API calls 2 library calls 67738->67745 67740->67738 67741 23196c 67740->67741 67742 3293de 3 API calls 67741->67742 67743 23197b __fread_nolock 67742->67743 67743->67690 67761 28bd10 67746->67761 67748 24a473 67750 3294aa _ValidateLocalCookies 5 API calls 67748->67750 67752 24a47e GetFileAttributesW 67750->67752 67753 24a4b0 67752->67753 67754 24a4d0 67753->67754 67755 24a4e8 67753->67755 67843 28c080 67754->67843 67864 24a5b0 162 API calls 2 library calls 67755->67864 67759 3294aa _ValidateLocalCookies 5 API calls 67760 24a4e2 67759->67760 67760->67510 67762 28bd35 67761->67762 67765 28bd7c 67761->67765 67816 23b640 7 API calls _ValidateLocalCookies 67762->67816 67764 28bd3f 67764->67765 67817 24b630 28 API calls 67764->67817 67771 28bde8 67765->67771 67819 23b640 7 API calls _ValidateLocalCookies 67765->67819 67768 28bd66 67818 23b700 10 API calls 67768->67818 67769 28bdab 67769->67771 67820 24b630 28 API calls 67769->67820 67799 2788c0 67771->67799 67773 28bdd2 67821 23b700 10 API calls 67773->67821 67777 28beba 67804 24b5f0 TlsGetValue 67777->67804 67780 28be78 67780->67777 67823 24b630 28 API calls 67780->67823 67784 28bed2 67786 28bedb 67784->67786 67825 2c2ce0 11 API calls 2 library calls 67784->67825 67785 28bea4 67824 23b700 10 API calls 67785->67824 67789 28bf1e 67786->67789 67791 28beeb 67786->67791 67796 28bf13 67786->67796 67789->67796 67827 28bfe0 35 API calls _ValidateLocalCookies 67789->67827 67791->67796 67826 28bb10 11 API calls 2 library calls 67791->67826 67793 28bf83 67794 3294aa _ValidateLocalCookies 5 API calls 67793->67794 67795 24a46a 67794->67795 67795->67748 67798 24a770 162 API calls 3 library calls 67795->67798 67796->67793 67828 277de0 123 API calls _ValidateLocalCookies 67796->67828 67798->67748 67829 277be0 67799->67829 67802 3294aa _ValidateLocalCookies 5 API calls 67803 278912 67802->67803 67803->67777 67822 23b640 7 API calls _ValidateLocalCookies 67803->67822 67805 24b614 67804->67805 67806 24b60b 67804->67806 67808 2d3fd0 67805->67808 67806->67805 67839 24b3c0 25 API calls 4 library calls 67806->67839 67809 2d3fdf 67808->67809 67812 2d402b 67808->67812 67840 23b640 7 API calls _ValidateLocalCookies 67809->67840 67811 2d3fe9 67811->67812 67841 24b630 28 API calls 67811->67841 67812->67784 67814 2d4015 67842 23b700 10 API calls 67814->67842 67816->67764 67817->67768 67818->67765 67819->67769 67820->67773 67821->67771 67822->67780 67823->67785 67824->67777 67825->67786 67827->67796 67828->67793 67830 277c03 67829->67830 67836 277c27 67829->67836 67837 24b250 TlsGetValue 67830->67837 67832 277c08 67832->67836 67838 277eb0 138 API calls 67832->67838 67833 3294aa _ValidateLocalCookies 5 API calls 67834 277cd6 67833->67834 67834->67802 67836->67833 67837->67832 67838->67836 67839->67805 67840->67811 67841->67814 67842->67812 67865 2766b0 67843->67865 67845 28c0af 67856 28c106 67845->67856 67879 23b640 7 API calls _ValidateLocalCookies 67845->67879 67846 24b5f0 26 API calls 67849 28c11b 67846->67849 67848 28c0c4 67848->67856 67880 24b630 28 API calls 67848->67880 67870 2766e0 SetLastError 67849->67870 67852 28c0f0 67881 23b700 10 API calls 67852->67881 67853 28c174 67873 277cf0 67853->67873 67855 28c135 67855->67853 67882 28b750 35 API calls 2 library calls 67855->67882 67856->67846 67859 3294aa _ValidateLocalCookies 5 API calls 67860 24a4d7 67859->67860 67860->67759 67862 28c160 67862->67853 67883 28bb10 11 API calls 2 library calls 67862->67883 67864->67754 67884 33a7f2 67865->67884 67868 33a7f2 __dosmaperr 11 API calls 67869 2766c4 GetLastError SetLastError 67868->67869 67869->67845 67871 33a7f2 __dosmaperr 11 API calls 67870->67871 67872 2766f6 67871->67872 67872->67855 67874 277d96 67873->67874 67875 277d05 67873->67875 67874->67859 67875->67874 67876 277d1e TryAcquireSRWLockExclusive 67875->67876 67878 277d36 67876->67878 67877 277d8d ReleaseSRWLockExclusive 67877->67874 67878->67877 67879->67848 67880->67852 67881->67856 67882->67862 67887 346fb1 11 API calls 2 library calls 67884->67887 67886 2766bb 67886->67868 67887->67886 67888->67517 67889->67520 67891 23154c 67890->67891 67892 23190e 23 API calls 67891->67892 67893 231579 CatchIt 67891->67893 67892->67893 67893->67484 67895 3293de 3 API calls 67894->67895 67896 215d3c 67895->67896 67896->67138 67902 2485f0 67897->67902 67900 3294aa _ValidateLocalCookies 5 API calls 67901 2485d9 67900->67901 67901->67148 67903 248626 __fread_nolock 67902->67903 67904 2766b0 13 API calls 67903->67904 67905 248654 67904->67905 67923 32eea9 67905->67923 67907 24867a 67914 2486a0 67907->67914 67926 32ee85 46 API calls 67907->67926 67908 2486b8 67927 230920 67908->67927 67910 3293de 3 API calls 67918 2486d0 __fread_nolock 67910->67918 67912 2766e0 12 API calls 67913 2487c5 67912->67913 67915 3294aa _ValidateLocalCookies 5 API calls 67913->67915 67914->67908 67914->67918 67922 2486bf 67914->67922 67916 2485cc 67915->67916 67916->67900 67917 32eea9 46 API calls 67917->67918 67918->67910 67918->67917 67919 2487a1 67918->67919 67918->67922 67931 32ee85 46 API calls 67918->67931 67921 230920 23 API calls 67919->67921 67921->67922 67922->67912 67932 32f401 67923->67932 67925 32eecb 67925->67907 67926->67914 67928 230934 67927->67928 67930 230967 __fread_nolock 67928->67930 67967 2309ae 23 API calls __fread_nolock 67928->67967 67930->67922 67931->67918 67933 32f422 67932->67933 67934 32f40d 67932->67934 67936 32f433 67933->67936 67939 32f456 67933->67939 67935 33a7f2 __dosmaperr 11 API calls 67934->67935 67937 32f412 67935->67937 67938 33a7f2 __dosmaperr 11 API calls 67936->67938 67962 32f43c 67936->67962 67963 33be02 22 API calls ___std_exception_copy 67937->67963 67941 32f4e0 67938->67941 67942 33a7f2 __dosmaperr 11 API calls 67939->67942 67966 33be02 22 API calls ___std_exception_copy 67941->67966 67944 32f45b 67942->67944 67943 32f41d 67943->67925 67946 32f495 67944->67946 67947 32f468 67944->67947 67965 331946 46 API calls 4 library calls 67946->67965 67964 331946 46 API calls 4 library calls 67947->67964 67950 32f4a7 67952 32f4cf 67950->67952 67954 32f4b9 67950->67954 67951 32f47a 67951->67952 67953 32f482 67951->67953 67959 33a7f2 __dosmaperr 11 API calls 67952->67959 67952->67962 67955 33a7f2 __dosmaperr 11 API calls 67953->67955 67956 33a7f2 __dosmaperr 11 API calls 67954->67956 67957 32f487 67955->67957 67958 32f4be 67956->67958 67960 33a7f2 __dosmaperr 11 API calls 67957->67960 67957->67962 67961 33a7f2 __dosmaperr 11 API calls 67958->67961 67958->67962 67959->67941 67960->67962 67961->67962 67962->67925 67963->67943 67964->67951 67965->67950 67966->67962 67967->67930 67969 230648 67968->67969 67971 230675 CatchIt 67969->67971 67972 2309ae 23 API calls __fread_nolock 67969->67972 67971->67304 67972->67971 67973->67312 67976 26ffb4 67975->67976 68003 26f782 67976->68003 67980 26ffee __fread_nolock 68095 2ac768 67980->68095 67982 270035 GetCurrentProcessId 68098 243aa0 67982->68098 67984 270045 __fread_nolock 67985 2ac768 3 API calls 67984->67985 67986 27007b 67985->67986 68108 271ee0 67986->68108 67988 270095 __fread_nolock 67989 2ac768 3 API calls 67988->67989 67991 2700cb 67989->67991 67990 270163 67994 3294aa _ValidateLocalCookies 5 API calls 67990->67994 67991->67990 67992 3293de 3 API calls 67991->67992 67993 270103 67992->67993 68111 2b7b42 67993->68111 67995 270178 67994->67995 67995->67324 67997 270123 68114 270242 67997->68114 68001 27015c 68145 270353 121 API calls _ValidateLocalCookies 68001->68145 68004 26f7b2 68003->68004 68005 2373d0 3 API calls 68004->68005 68006 26f7d5 68005->68006 68007 26fb16 68006->68007 68008 26f7ea 68006->68008 68010 26fb3f 68007->68010 68011 26fb6c 68007->68011 68090 219030 243 API calls 68008->68090 68009 26f802 68015 237cd0 35 API calls 68009->68015 68016 26f828 68009->68016 68012 2701db 14 API calls 68010->68012 68089 26fdf1 68011->68089 68146 216204 68011->68146 68013 26fb44 68012->68013 68232 248e60 68013->68232 68015->68016 68018 26f860 68016->68018 68024 26f8a1 68016->68024 68020 237cd0 35 API calls 68018->68020 68034 26f878 68020->68034 68021 26fc9f 68026 1f3696 121 API calls 68021->68026 68023 1f3696 121 API calls 68027 26fbf3 68023->68027 68032 26f896 68024->68032 68042 26f8f2 68024->68042 68028 26fcaf 68026->68028 68031 2168a0 35 API calls 68027->68031 68030 230aa2 23 API calls 68028->68030 68036 26fcbb 68030->68036 68065 26fbfd 68031->68065 68032->68024 68037 237cd0 35 API calls 68032->68037 68043 26fed8 68032->68043 68033 3294aa _ValidateLocalCookies 5 API calls 68038 26fecd 68033->68038 68219 252df0 198 API calls _ValidateLocalCookies 68034->68219 68035 26f920 68221 2304ce 68035->68221 68152 2168a0 68036->68152 68037->68042 68091 2ac50c 68038->68091 68220 26f1b4 309 API calls 3 library calls 68042->68220 68044 26fedb 68043->68044 68045 1f3696 121 API calls 68045->68065 68046 26f93b __fread_nolock 68049 26f9b8 68046->68049 68055 26f976 GetModuleFileNameW 68046->68055 68047 26fce3 68159 2701db 68047->68159 68052 216204 23 API calls 68049->68052 68051 230920 23 API calls 68051->68065 68054 26f9e7 68052->68054 68058 26fb74 68054->68058 68059 26f9ef 68054->68059 68055->68044 68060 26f98e 68055->68060 68056 26fd45 68063 2701db 14 API calls 68056->68063 68057 2168a0 35 API calls 68057->68065 68061 238610 35 API calls 68058->68061 68062 1f3696 121 API calls 68059->68062 68067 237cd0 35 API calls 68060->68067 68064 26fb8c 68061->68064 68066 26f9ff 68062->68066 68068 26fd58 68063->68068 68069 238b80 35 API calls 68064->68069 68065->68021 68065->68045 68065->68051 68065->68057 68070 230aa2 23 API calls 68066->68070 68067->68049 68229 26c49e 23 API calls 68068->68229 68082 26fafb 68069->68082 68072 26fa0b 68070->68072 68074 2168a0 35 API calls 68072->68074 68073 26fd60 68230 2492e0 23 API calls 68073->68230 68076 26fa34 68074->68076 68078 1f3696 121 API calls 68076->68078 68086 26fabc 68076->68086 68077 1f3696 121 API calls 68079 26faee 68077->68079 68080 26fa7c 68078->68080 68081 2168a0 35 API calls 68079->68081 68083 230920 23 API calls 68080->68083 68081->68082 68082->68011 68084 26fa94 68083->68084 68085 2168a0 35 API calls 68084->68085 68085->68086 68086->68077 68087 26fd79 68231 2010fe 5 API calls _ValidateLocalCookies 68087->68231 68089->68033 68090->68009 68092 2ac515 68091->68092 68093 3293de 3 API calls 68092->68093 68094 2ac523 68092->68094 68093->68094 68094->67980 68096 2ac50c 3 API calls 68095->68096 68097 2ac779 68096->68097 68097->67982 68099 243ae0 68098->68099 68099->68099 68100 243b94 68099->68100 68101 243b22 68099->68101 68711 230494 23 API calls 68100->68711 68104 3293de 3 API calls 68101->68104 68105 243b27 __fread_nolock 68101->68105 68104->68105 68106 3294aa _ValidateLocalCookies 5 API calls 68105->68106 68107 243b8a 68106->68107 68107->67984 68712 258690 68108->68712 68721 2b73d8 68111->68721 68115 2702b5 68114->68115 68118 27025d 68114->68118 68116 3294aa _ValidateLocalCookies 5 API calls 68115->68116 68117 270142 68116->68117 68120 2b880a 68117->68120 68922 2b870c 68118->68922 68121 2b8358 136 API calls 68120->68121 68122 2b8853 68121->68122 68123 2b88a0 68122->68123 68125 2b87cc 126 API calls 68122->68125 68124 2b88c8 68123->68124 68138 2b8893 68123->68138 68126 2b8358 136 API calls 68124->68126 68127 2b8873 68125->68127 68130 2b8915 68126->68130 68127->68124 68128 2b8882 68127->68128 68131 2ea9da 125 API calls 68128->68131 68129 3294aa _ValidateLocalCookies 5 API calls 68132 2b88bc 68129->68132 68135 2b87cc 126 API calls 68130->68135 68144 2b8951 68130->68144 68133 2b888a 68131->68133 68132->68001 68136 2d6537 128 API calls 68133->68136 68134 2b8986 68137 2b8931 68135->68137 68136->68138 68137->68134 68140 2ea9da 125 API calls 68137->68140 68138->68129 68139 3294aa _ValidateLocalCookies 5 API calls 68141 2b897a 68139->68141 68142 2b8948 68140->68142 68141->68001 68143 2d6537 128 API calls 68142->68143 68143->68144 68144->68134 68144->68139 68145->67990 68147 216221 68146->68147 68149 216253 68146->68149 68238 1f5706 RaiseException EnterCriticalSection LeaveCriticalSection 68147->68238 68149->68021 68149->68023 68150 2304ce 23 API calls 68151 216232 68150->68151 68151->68149 68151->68150 68153 2168c6 68152->68153 68154 2168e9 68152->68154 68157 3294aa _ValidateLocalCookies 5 API calls 68153->68157 68155 2169fb 68154->68155 68239 1f4170 35 API calls _unexpected 68154->68239 68158 2169f1 68157->68158 68158->68047 68160 270204 68159->68160 68166 26fd0d 68159->68166 68161 3294e7 __Init_thread_header 6 API calls 68160->68161 68162 27020e 68161->68162 68163 3293de 3 API calls 68162->68163 68162->68166 68164 270221 68163->68164 68165 32955d __Init_thread_footer 5 API calls 68164->68165 68165->68166 68167 26ad1e GetCurrentProcessId 68166->68167 68168 248590 50 API calls 68167->68168 68172 26ad61 68168->68172 68170 248e60 23 API calls 68170->68172 68172->68170 68173 26b0ca 68172->68173 68174 26aeae 68172->68174 68192 26aedd 68172->68192 68240 2ac868 68172->68240 68245 2acb18 68172->68245 68450 2ac794 68172->68450 68175 33d9b4 _unexpected 34 API calls 68173->68175 68467 28d580 122 API calls 68174->68467 68180 26b0cf 68175->68180 68176 26aefd CreateEventW CreateEventW CreateEventW 68253 26b0cf 68176->68253 68470 2acdd8 GetVersion 68180->68470 68181 26af57 SetUnhandledExceptionFilter 68184 343723 13 API calls 68181->68184 68182 26aec6 68190 1f1741 121 API calls 68182->68190 68186 26af6e 68184->68186 68189 3293de 3 API calls 68186->68189 68187 3293de 3 API calls 68188 26b0e7 68187->68188 68188->68056 68191 26af78 68189->68191 68190->68192 68193 2304ce 23 API calls 68191->68193 68192->68176 68194 26afb6 68193->68194 68258 26c972 68194->68258 68197 216204 23 API calls 68198 26aff1 68197->68198 68264 1f4418 68198->68264 68200 26affc 68201 2313a0 23 API calls 68200->68201 68202 26b007 68201->68202 68203 26b023 CreateThread 68202->68203 68204 26b0a1 68202->68204 68468 26b0fc 177 API calls 2 library calls 68203->68468 68268 26b18d 68204->68268 68207 26b0ad 68208 3294aa _ValidateLocalCookies 5 API calls 68207->68208 68209 26b0be 68208->68209 68209->68056 68210 26b046 68210->68207 68211 26b093 68210->68211 68469 23c840 GetLastError 68210->68469 68211->68207 68219->68032 68220->68035 68222 2304fa 68221->68222 68228 2304ea __fread_nolock 68221->68228 68223 230502 68222->68223 68224 230554 68222->68224 68227 3293de 3 API calls 68223->68227 68223->68228 68703 230494 23 API calls 68224->68703 68227->68228 68228->68046 68229->68073 68230->68087 68231->68089 68704 248ac0 68232->68704 68235 3294aa _ValidateLocalCookies 5 API calls 68236 248ea9 68235->68236 68237 26c3b6 142 API calls _ValidateLocalCookies 68236->68237 68237->68089 68238->68151 68239->68153 68241 2ac87f 68240->68241 68244 2ac89b 68241->68244 68493 241b70 68241->68493 68499 2306ea 68241->68499 68244->68172 68246 2acb49 GetVersion 68245->68246 68247 2acb73 CreateNamedPipeW 68245->68247 68246->68247 68248 2acb5e 68246->68248 68251 3294aa _ValidateLocalCookies 5 API calls 68247->68251 68514 2acbc3 68248->68514 68252 2acbb9 68251->68252 68252->68172 68254 2acdd8 129 API calls 68253->68254 68255 26b0dd 68254->68255 68256 3293de 3 API calls 68255->68256 68257 26b0e7 68256->68257 68257->68181 68259 26c9ba 68258->68259 68263 26c992 68258->68263 68260 3294aa _ValidateLocalCookies 5 API calls 68259->68260 68262 26afe6 68260->68262 68262->68197 68263->68259 68548 26c9ce 23 API calls _ValidateLocalCookies 68263->68548 68265 1f4435 68264->68265 68267 1f4446 68264->68267 68549 1f5706 RaiseException EnterCriticalSection LeaveCriticalSection 68265->68549 68267->68200 68269 26b1b1 68268->68269 68272 26c36e 68269->68272 68550 2acf24 68269->68550 68271 26b23b 68274 1f3696 121 API calls 68271->68274 68289 26b287 68271->68289 68273 33d9b4 _unexpected 34 API calls 68272->68273 68276 26c385 68273->68276 68277 26b263 68274->68277 68275 248e60 23 API calls 68283 26b1d6 68275->68283 68647 26cc9a 23 API calls _ValidateLocalCookies 68277->68647 68278 1f3696 121 API calls 68281 26b2d6 68278->68281 68280 2acf24 23 API calls 68280->68283 68648 26cc9a 23 API calls _ValidateLocalCookies 68281->68648 68282 26b276 68286 2acf24 23 API calls 68282->68286 68283->68271 68283->68275 68283->68280 68284 1f3696 121 API calls 68287 26b349 68284->68287 68286->68289 68649 26cc9a 23 API calls _ValidateLocalCookies 68287->68649 68288 26b2e9 68291 2acf24 23 API calls 68288->68291 68289->68278 68293 26b2fa 68289->68293 68291->68293 68292 26b35c 68296 2acf24 23 API calls 68292->68296 68293->68284 68300 26b36d 68293->68300 68294 26b643 GetCurrentProcessId OpenProcess 68298 26b65f 68294->68298 68305 26b71f 68294->68305 68296->68300 68297 248e60 23 API calls 68301 26b3cc 68297->68301 68554 2ad35e 68298->68554 68299 1f3696 121 API calls 68324 26b5c5 68299->68324 68300->68297 68337 26b404 68300->68337 68302 1f3696 121 API calls 68301->68302 68306 26b3e2 68302->68306 68304 26b776 68665 26cc1a 128 API calls 68304->68665 68305->68304 68654 23c840 GetLastError 68305->68654 68650 26cc9a 23 API calls _ValidateLocalCookies 68306->68650 68308 230920 23 API calls 68308->68337 68312 2acf24 23 API calls 68312->68324 68315 26b3f3 68320 2acf24 23 API calls 68315->68320 68316 1f3696 121 API calls 68321 26b6d4 68316->68321 68317 248e60 23 API calls 68317->68337 68318 26bd4f 68322 3294aa _ValidateLocalCookies 5 API calls 68318->68322 68320->68337 68328 230920 23 API calls 68321->68328 68326 26bd5d 68322->68326 68324->68294 68324->68299 68324->68312 68653 26cc9a 23 API calls _ValidateLocalCookies 68324->68653 68325 1f3696 121 API calls 68325->68337 68326->68207 68330 26b6f3 68328->68330 68334 248e60 23 API calls 68330->68334 68333 2acf24 23 API calls 68333->68337 68335 26b792 68334->68335 68336 2acf24 23 API calls 68335->68336 68341 26b7a3 68336->68341 68337->68308 68337->68317 68337->68324 68337->68325 68337->68333 68651 1ffbc0 23 API calls __fread_nolock 68337->68651 68652 26cc9a 23 API calls _ValidateLocalCookies 68337->68652 68338 26b7fa GetStdHandle GetStdHandle GetStdHandle 68339 26c2d7 68338->68339 68340 26b8bf 68338->68340 68342 3294e7 __Init_thread_header 6 API calls 68339->68342 68344 3294e7 __Init_thread_header 6 API calls 68340->68344 68351 26b8e0 68340->68351 68341->68338 68343 26c2e1 68342->68343 68343->68340 68345 26c2f1 68343->68345 68346 26c326 68344->68346 68668 2ad41c LoadLibraryW GetProcAddress 68345->68668 68348 26c355 68346->68348 68349 26c33f 68346->68349 68346->68351 68358 32955d __Init_thread_footer 5 API calls 68348->68358 68669 2ad41c LoadLibraryW GetProcAddress 68349->68669 68350 26b968 68361 26b99f 68350->68361 68655 231444 23 API calls __fread_nolock 68350->68655 68351->68350 68354 26b9a6 GetLastError 68351->68354 68366 26b919 68351->68366 68352 26c302 68355 32955d __Init_thread_footer 5 API calls 68352->68355 68359 26b9b5 68354->68359 68367 26bc72 68354->68367 68360 26c314 68355->68360 68356 26c350 68356->68348 68358->68351 68365 26b9be InitializeProcThreadAttributeList 68359->68365 68360->68340 68362 26babd CreateProcessW 68361->68362 68364 26bae7 CloseHandle 68362->68364 68377 26bc15 68362->68377 68363 26ba45 68656 3400e1 43 API calls 3 library calls 68363->68656 68382 26bafd 68364->68382 68369 26b9de 68365->68369 68385 26bd67 68365->68385 68370 23bec0 121 API calls 68366->68370 68376 26b963 68366->68376 68367->68376 68663 23c840 GetLastError 68367->68663 68558 26cfe4 68369->68558 68373 26b945 68370->68373 68380 1f1741 121 API calls 68373->68380 68374 26bcdd 68381 26cfe4 14 API calls 68374->68381 68375 26bb3c 68386 26bb57 CloseHandle 68375->68386 68658 23ca90 123 API calls _ValidateLocalCookies 68375->68658 68376->68272 68376->68374 68377->68376 68661 23c840 GetLastError 68377->68661 68388 26b959 68380->68388 68391 26bce9 68381->68391 68382->68375 68657 23c840 GetLastError 68382->68657 68385->68376 68666 23c840 GetLastError 68385->68666 68407 26bb6d 68386->68407 68390 23c2a0 121 API calls 68388->68390 68390->68376 68401 26bcf3 68391->68401 68400 26bba6 68411 26bbbe 68400->68411 68660 23ca90 123 API calls _ValidateLocalCookies 68400->68660 68401->68391 68664 2ac79e 123 API calls _ValidateLocalCookies 68401->68664 68406 26ba0a 68406->68272 68421 26ba18 __fread_nolock 68406->68421 68422 3293de 3 API calls 68406->68422 68407->68400 68659 23c840 GetLastError 68407->68659 68576 26c8a0 68411->68576 68414 26bd1a 68414->68304 68421->68272 68428 26be90 __fread_nolock 68421->68428 68431 3293de 3 API calls 68421->68431 68422->68421 68428->68272 68431->68428 68451 2d6537 68450->68451 68679 2eac0e CloseHandle 68451->68679 68454 2d6549 68454->68172 68456 2d65cf 68457 3294aa _ValidateLocalCookies 5 API calls 68456->68457 68458 2d65d9 68457->68458 68458->68172 68459 2d6576 68459->68456 68699 23c840 GetLastError 68459->68699 68467->68182 68468->68210 68471 2ace08 68470->68471 68472 2ace99 InitializeCriticalSection 68470->68472 68471->68472 68474 2ace16 68471->68474 68473 2ace92 68472->68473 68475 3294aa _ValidateLocalCookies 5 API calls 68473->68475 68476 2ace37 InitializeCriticalSectionEx 68474->68476 68478 3294e7 __Init_thread_header 6 API calls 68474->68478 68477 26b0dd 68475->68477 68476->68473 68481 2ace4b 68476->68481 68477->68187 68479 2acec3 68478->68479 68479->68476 68480 2aced3 68479->68480 68702 2ad41c LoadLibraryW GetProcAddress 68480->68702 68481->68473 68701 23c840 GetLastError 68481->68701 68484 2acee4 68486 32955d __Init_thread_footer 5 API calls 68484->68486 68488 2acef6 68486->68488 68488->68476 68495 241bb4 __aullrem 68493->68495 68496 241bfb __aullrem 68495->68496 68503 259a00 68495->68503 68497 3294aa _ValidateLocalCookies 5 API calls 68496->68497 68498 241c19 68497->68498 68498->68241 68500 2306f9 68499->68500 68502 230732 __fread_nolock 68499->68502 68500->68502 68513 230ac4 23 API calls __fread_nolock 68500->68513 68502->68241 68504 259a17 68503->68504 68505 259a0a SystemFunction036 68503->68505 68504->68495 68505->68504 68506 259a19 68505->68506 68507 259a8d __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 68506->68507 68508 259a4f GetSystemTimeAsFileTime 68506->68508 68509 259b7d 68507->68509 68511 259af7 GetSystemTimeAsFileTime 68507->68511 68508->68507 68510 3294aa _ValidateLocalCookies 5 API calls 68509->68510 68512 259c66 68510->68512 68511->68507 68512->68495 68513->68502 68517 2acbe5 68514->68517 68515 2acdd2 68516 2acc0a 68520 3294aa _ValidateLocalCookies 5 API calls 68516->68520 68517->68515 68517->68516 68518 3294e7 __Init_thread_header 6 API calls 68517->68518 68519 2acc56 68518->68519 68519->68516 68521 2acc62 ConvertStringSecurityDescriptorToSecurityDescriptorW 68519->68521 68522 2acc42 68520->68522 68523 2acc8d BuildExplicitAccessWithNameW BuildSecurityDescriptorW 68521->68523 68528 2acd55 68521->68528 68522->68247 68524 2acd53 68523->68524 68525 2acd03 SetLastError 68523->68525 68527 2acd98 68524->68527 68547 2d6608 125 API calls _ValidateLocalCookies 68524->68547 68526 2acd13 68525->68526 68526->68524 68545 23c840 GetLastError 68526->68545 68530 32955d __Init_thread_footer 5 API calls 68527->68530 68528->68527 68546 23c840 GetLastError 68528->68546 68530->68516 68547->68527 68548->68263 68549->68267 68551 2acf38 68550->68551 68552 231878 23 API calls 68551->68552 68553 2acfaf 68551->68553 68552->68553 68553->68283 68555 2ad38d 68554->68555 68556 248590 50 API calls 68555->68556 68557 26b6c4 68556->68557 68557->68316 68559 26cff0 68558->68559 68560 26b9f0 68558->68560 68561 26d00f DeleteProcThreadAttributeList 68559->68561 68562 3294e7 __Init_thread_header 6 API calls 68559->68562 68569 26cdde 68560->68569 68561->68560 68563 26d02b 68562->68563 68563->68561 68564 26d037 68563->68564 68670 2ad41c LoadLibraryW GetProcAddress 68564->68670 68566 26d048 68570 26cdfa 68569->68570 68575 26ce17 __fread_nolock 68569->68575 68571 26ce65 68570->68571 68572 26ce02 68570->68572 68574 33d9b4 _unexpected 34 API calls 68571->68574 68573 3293de 3 API calls 68572->68573 68573->68575 68574->68571 68575->68406 68647->68282 68648->68288 68649->68292 68650->68315 68651->68337 68652->68337 68653->68324 68655->68363 68656->68361 68658->68386 68660->68411 68664->68414 68665->68318 68668->68352 68669->68356 68670->68566 68682 2eac38 68679->68682 68680 2eac7f 68681 3294aa _ValidateLocalCookies 5 API calls 68680->68681 68683 2d6542 68681->68683 68682->68680 68700 23c840 GetLastError 68682->68700 68683->68454 68691 2ea51e ReadFile 68683->68691 68692 2ea596 GetLastError 68691->68692 68694 2ea55d 68691->68694 68693 2ea5a8 68692->68693 68695 3294aa _ValidateLocalCookies 5 API calls 68693->68695 68696 2ea5c6 68693->68696 68694->68693 68698 2ea578 ReadFile 68694->68698 68697 2ea5b7 68695->68697 68697->68459 68698->68692 68698->68694 68702->68484 68705 248ae1 68704->68705 68706 248ae8 68705->68706 68710 231690 23 API calls __fread_nolock 68705->68710 68707 3294aa _ValidateLocalCookies 5 API calls 68706->68707 68708 248e4e 68707->68708 68708->68235 68710->68706 68713 258704 68712->68713 68714 2586c2 68712->68714 68715 3294e7 __Init_thread_header 6 API calls 68713->68715 68718 3294aa _ValidateLocalCookies 5 API calls 68714->68718 68716 25870e 68715->68716 68716->68714 68717 25871a GetNativeSystemInfo 68716->68717 68720 32955d __Init_thread_footer 5 API calls 68717->68720 68719 2586fc 68718->68719 68719->67988 68720->68714 68722 3293de 3 API calls 68721->68722 68723 2b73eb 68722->68723 68726 2b526e 68723->68726 68727 2b5290 68726->68727 68728 2b5297 68726->68728 68742 2b5307 68727->68742 68763 2b5423 68728->68763 68731 2b5295 68732 238b80 35 API calls 68731->68732 68741 2b52e4 68731->68741 68734 2b52b2 68732->68734 68733 3294aa _ValidateLocalCookies 5 API calls 68735 2b52fb 68733->68735 68736 2b5307 126 API calls 68734->68736 68735->67997 68737 2b52b9 68736->68737 68738 238b80 35 API calls 68737->68738 68737->68741 68739 2b52dc 68738->68739 68793 2b82ae 68739->68793 68741->68733 68743 2b5329 CreateDirectoryW 68742->68743 68744 2b5327 68742->68744 68745 2b533c GetLastError 68743->68745 68750 2b540a 68743->68750 68744->68743 68747 2b5349 68745->68747 68751 2b5353 68745->68751 68746 3294aa _ValidateLocalCookies 5 API calls 68748 2b5416 68746->68748 68749 3294aa _ValidateLocalCookies 5 API calls 68747->68749 68748->68731 68749->68751 68750->68746 68751->68750 68805 23c840 GetLastError 68751->68805 68764 2b5443 68763->68764 68765 2b5445 GetFileAttributesW 68763->68765 68764->68765 68768 2b5455 68765->68768 68770 2b5514 68765->68770 68766 2b550f 68767 3294aa _ValidateLocalCookies 5 API calls 68766->68767 68769 2b55c6 68767->68769 68768->68766 68773 23bec0 121 API calls 68768->68773 68769->68731 68770->68766 68807 23c840 GetLastError 68770->68807 68775 2b5488 68773->68775 68777 1f1741 121 API calls 68775->68777 68779 2b549b 68777->68779 68806 2492e0 23 API calls 68779->68806 68783 2b54bb 68785 1f1741 121 API calls 68783->68785 68786 2b54da 68785->68786 68788 1f1741 121 API calls 68786->68788 68790 2b54ea 68788->68790 68792 23c2a0 121 API calls 68790->68792 68792->68766 68794 237db0 23 API calls 68793->68794 68795 2b82d7 68794->68795 68808 2b8358 68795->68808 68798 2b8354 68800 2b8323 68802 3294aa _ValidateLocalCookies 5 API calls 68800->68802 68804 2b8348 68802->68804 68804->68741 68806->68783 68809 2b8392 68808->68809 68841 2b8388 68808->68841 68871 2ea5fd 68809->68871 68817 2b83d0 68821 2ea5fd CreateFileW 68817->68821 68825 2b83d8 68817->68825 68820 2b83ae 68826 2ac794 128 API calls 68820->68826 68829 2b83bb 68820->68829 68827 2b83ec 68821->68827 68822 2b8509 68823 2b848b 68823->68822 68828 2b84e9 68823->68828 68831 2ea9da 125 API calls 68823->68831 68824 2b844f 68832 2ac794 128 API calls 68824->68832 68836 2b845c 68824->68836 68825->68823 68891 2b898a 68825->68891 68826->68829 68830 2b840b 68827->68830 68916 2ea927 125 API calls _ValidateLocalCookies 68827->68916 68833 3294aa _ValidateLocalCookies 5 API calls 68828->68833 68915 2b8aa8 136 API calls 2 library calls 68829->68915 68917 2b8aa8 136 API calls 2 library calls 68830->68917 68835 2b84e0 68831->68835 68832->68836 68838 2b8300 68833->68838 68840 2d6537 128 API calls 68835->68840 68919 2b8aa8 136 API calls 2 library calls 68836->68919 68838->68798 68838->68800 68843 2ea9da UnlockFileEx 68838->68843 68839 2b83fe 68839->68830 68842 2ac794 128 API calls 68839->68842 68840->68828 68841->68825 68874 2ea829 68841->68874 68842->68830 68844 2eaa67 68843->68844 68846 2eaa21 68843->68846 68845 3294aa _ValidateLocalCookies 5 API calls 68844->68845 68847 2b831a 68845->68847 68846->68844 68920 23c840 GetLastError 68846->68920 68855 2d6537 68847->68855 68856 2eac0e 125 API calls 68855->68856 68857 2d6542 68856->68857 68858 2d6549 68857->68858 68859 2ea51e 8 API calls 68857->68859 68858->68800 68863 2d6576 68859->68863 68860 2d65cf 68861 3294aa _ValidateLocalCookies 5 API calls 68860->68861 68862 2d65d9 68861->68862 68862->68800 68863->68860 68921 23c840 GetLastError 68863->68921 68872 2ea5c9 CreateFileW 68871->68872 68873 2b839c 68872->68873 68873->68829 68914 2ea927 125 API calls _ValidateLocalCookies 68873->68914 68875 2ea5c9 CreateFileW 68874->68875 68876 2ea853 68875->68876 68877 2ea910 68876->68877 68879 23c840 GetLastError 68876->68879 68878 3294aa _ValidateLocalCookies 5 API calls 68877->68878 68880 2b843d 68878->68880 68881 2ea878 68879->68881 68880->68836 68918 2ea927 125 API calls _ValidateLocalCookies 68880->68918 68882 23c9e0 121 API calls 68881->68882 68883 2ea890 68882->68883 68884 1f1741 121 API calls 68883->68884 68885 2ea8a3 68884->68885 68886 2492e0 23 API calls 68885->68886 68887 2ea8c7 68886->68887 68888 1f1741 121 API calls 68887->68888 68889 2ea8eb 68888->68889 68890 23ca90 123 API calls 68889->68890 68890->68877 68892 2eaa84 125 API calls 68891->68892 68893 2b89ae 68892->68893 68894 2b8a8c 68893->68894 68896 2b89cd 68893->68896 68897 2b89c2 68893->68897 68895 3294aa _ValidateLocalCookies 5 API calls 68894->68895 68899 2b8a98 68895->68899 68898 2d63fd 128 API calls 68896->68898 68900 2d6443 128 API calls 68897->68900 68901 2b89cb 68898->68901 68899->68823 68900->68901 68901->68894 68902 2b89e9 68901->68902 68903 2b8a3c 68901->68903 68902->68894 68906 23bec0 121 API calls 68902->68906 68903->68894 68904 23bec0 121 API calls 68903->68904 68905 2b8a63 68904->68905 68907 1f1741 121 API calls 68905->68907 68908 2b8a20 68906->68908 68909 2b8a33 68907->68909 68910 1f1741 121 API calls 68908->68910 68911 21a3e0 121 API calls 68909->68911 68910->68909 68912 2b8a85 68911->68912 68913 23c2a0 121 API calls 68912->68913 68913->68894 68914->68820 68915->68817 68916->68839 68917->68841 68918->68824 68919->68825 68923 2b8358 136 API calls 68922->68923 68924 2b8755 68923->68924 68928 2b8794 68924->68928 68934 2b87cc 68924->68934 68926 2b87c9 68928->68926 68929 3294aa _ValidateLocalCookies 5 API calls 68928->68929 68931 2b87bd 68929->68931 68930 2ea9da 125 API calls 68932 2b878b 68930->68932 68931->68115 68933 2d6537 128 API calls 68932->68933 68933->68928 68941 2eaa84 SetFilePointerEx 68934->68941 68938 2b8774 68938->68926 68938->68930 68942 2eaaff 68941->68942 68943 2eab0f 68941->68943 68944 3294aa _ValidateLocalCookies 5 API calls 68942->68944 68943->68942 68980 23c840 GetLastError 68943->68980 68945 2b87de 68944->68945 68945->68938 68953 2eab75 68945->68953 68954 2eaa84 125 API calls 68953->68954 68955 2eab98 68954->68955 68956 2eab9f SetEndOfFile 68955->68956 68957 2eabf6 68955->68957 68956->68957 68960 2eabac 68956->68960 68958 3294aa _ValidateLocalCookies 5 API calls 68957->68958 68959 2b87eb 68958->68959 68959->68938 68968 2d6489 68959->68968 68960->68957 68981 23c840 GetLastError 68960->68981 68972 2d64b8 68968->68972 68969 2d651a 68970 3294aa _ValidateLocalCookies 5 API calls 68969->68970 68971 2d652a 68970->68971 68971->68938 68972->68969 68982 23c840 GetLastError 68972->68982 68985 231bcc 68984->68985 68986 231536 23 API calls 68985->68986 68987 231bd8 68986->68987 68987->67434 68988->67451 68989->66719 68990->66720 68992 248876 __fread_nolock 68991->68992 68993 2766b0 13 API calls 68992->68993 68994 2488a4 68993->68994 69012 32eddb 68994->69012 68996 2488f0 68997 248908 68996->68997 69008 248920 __fread_nolock 68996->69008 69011 24890f 68996->69011 68999 231878 23 API calls 68997->68999 68998 2488ca 68998->68996 69015 32edb7 45 API calls 68998->69015 68999->69011 69000 3293de 3 API calls 69000->69008 69002 2766e0 12 API calls 69003 248a25 69002->69003 69004 3294aa _ValidateLocalCookies 5 API calls 69003->69004 69005 24881c 69004->69005 69005->66733 69006 32eddb 45 API calls 69006->69008 69007 248a01 69009 231878 23 API calls 69007->69009 69008->69000 69008->69006 69008->69007 69008->69011 69016 32edb7 45 API calls 69008->69016 69009->69011 69011->69002 69017 32f500 69012->69017 69014 32edfd 69014->68998 69015->68996 69016->69008 69018 32f521 69017->69018 69019 32f50c 69017->69019 69021 32f532 69018->69021 69024 32f555 69018->69024 69020 33a7f2 __dosmaperr 11 API calls 69019->69020 69022 32f511 69020->69022 69023 33a7f2 __dosmaperr 11 API calls 69021->69023 69033 32f53b 69021->69033 69048 33be02 22 API calls ___std_exception_copy 69022->69048 69045 32f5e3 69023->69045 69026 33a7f2 __dosmaperr 11 API calls 69024->69026 69028 32f55a 69026->69028 69027 32f51c 69027->69014 69030 32f567 69028->69030 69031 32f594 69028->69031 69049 331ac4 45 API calls 4 library calls 69030->69049 69050 331ac4 45 API calls 4 library calls 69031->69050 69033->69014 69035 32f5a6 69037 32f5d0 69035->69037 69039 32f5ba 69035->69039 69036 32f579 69036->69037 69038 32f581 69036->69038 69037->69033 69044 33a7f2 __dosmaperr 11 API calls 69037->69044 69040 33a7f2 __dosmaperr 11 API calls 69038->69040 69041 33a7f2 __dosmaperr 11 API calls 69039->69041 69042 32f586 69040->69042 69043 32f5bf 69041->69043 69042->69033 69046 33a7f2 __dosmaperr 11 API calls 69042->69046 69043->69033 69047 33a7f2 __dosmaperr 11 API calls 69043->69047 69044->69045 69051 33be02 22 API calls ___std_exception_copy 69045->69051 69046->69033 69047->69033 69048->69027 69049->69036 69050->69035 69051->69033 69052->66740 69053->66763 69054->66762 69055->66758 69057 232225 69056->69057 69058 23225a 23 API calls 69057->69058 69059 23223a 69058->69059 69059->66773 69059->66776 69062 234750 _strlen 69061->69062 69063 3294aa _ValidateLocalCookies 5 API calls 69062->69063 69064 234785 69063->69064 69064->66792 69064->66794 69066 23bbdc 69065->69066 69067 23bbc5 69065->69067 69070 3294aa _ValidateLocalCookies 5 API calls 69066->69070 69068 23bbe1 69067->69068 69069 23bbcf 69067->69069 69071 3293de 3 API calls 69068->69071 69069->69066 69073 23bce3 CreateFileW 69069->69073 69072 23be00 69070->69072 69074 23bbe8 __fread_nolock 69071->69074 69072->66797 69073->69066 69075 23bd1c __fread_nolock 69073->69075 69076 23bc03 GetModuleFileNameW 69074->69076 69077 23bd32 GetCurrentDirectoryW 69075->69077 69078 23bc2e 69076->69078 69077->69066 69081 23bd58 69077->69081 69079 23be0d 69078->69079 69080 23bc3c 69078->69080 69107 230494 23 API calls 69079->69107 69084 23be14 69080->69084 69085 23bc5a 69080->69085 69091 23bc43 __fread_nolock 69080->69091 69081->69066 69082 231bbc 23 API calls 69081->69082 69090 23bd6f 69082->69090 69086 33d9b4 _unexpected 34 API calls 69084->69086 69087 3293de 3 API calls 69085->69087 69088 23be19 69086->69088 69087->69091 69089 23bd98 69106 231a38 23 API calls 69089->69106 69090->69089 69105 231a38 23 API calls 69090->69105 69095 23bcbc 69091->69095 69103 231dd6 23 API calls CatchIt 69091->69103 69094 23bda8 69098 23bdb3 69094->69098 69099 23bdb5 CreateFileW 69094->69099 69104 231a38 23 API calls 69095->69104 69098->69099 69099->69066 69101 23bdea 69099->69101 69100 23bcc8 69100->69066 69100->69069 69101->69066 69102->66815 69103->69095 69104->69100 69105->69089 69106->69094 69184 22bad0 69108->69184 69111 219a56 69112 22bad0 11 API calls 69111->69112 69113 219a6a 69112->69113 69113->66821 69115 23bf8d _strlen 69114->69115 69193 245530 69115->69193 69118 23c295 69119 1f1741 119 API calls 69120 23bff9 _strlen 69119->69120 69125 1f1741 119 API calls 69120->69125 69142 23c028 69120->69142 69122 23c05b 69123 23c086 69122->69123 69224 211c60 GetCurrentThreadId 69122->69224 69126 23c096 GetLocalTime 69123->69126 69127 23c18b 69123->69127 69130 23c017 69125->69130 69225 21a020 121 API calls 69126->69225 69132 23c1b5 69127->69132 69133 23c194 GetTickCount 69127->69133 69128 23c03c 69223 276700 121 API calls 69128->69223 69137 1f1741 119 API calls 69130->69137 69135 23c1eb 69132->69135 69151 23c1bc _strlen 69132->69151 69231 21a7a0 121 API calls 69133->69231 69143 1f1741 119 API calls 69135->69143 69137->69142 69138 23c0ce 69226 21a020 121 API calls 69138->69226 69139 23c046 69146 1f1741 119 API calls 69139->69146 69142->69122 69222 276720 GetCurrentProcessId 69142->69222 69149 23c1f8 69143->69149 69145 23c1a4 69150 1f1741 119 API calls 69145->69150 69146->69122 69148 23c0e8 69153 1f1741 119 API calls 69148->69153 69152 21a200 119 API calls 69149->69152 69154 23c1b2 69150->69154 69155 1f1741 119 API calls 69151->69155 69157 23c1e0 69152->69157 69156 23c0fa 69153->69156 69154->69132 69155->69157 69227 21a020 121 API calls 69156->69227 69158 1f1741 119 API calls 69157->69158 69161 23c215 69158->69161 69160 23c117 69228 21a020 121 API calls 69160->69228 69197 244e00 69161->69197 69164 23c131 69229 21a020 121 API calls 69164->69229 69166 1f1741 119 API calls 69169 23c233 69166->69169 69168 23c14b 69171 1f1741 119 API calls 69168->69171 69200 21a200 69169->69200 69172 23c159 69171->69172 69230 21a020 121 API calls 69172->69230 69174 1f1741 119 API calls 69177 23c24d 69174->69177 69176 23c176 69179 1f1741 119 API calls 69176->69179 69212 1f5604 69177->69212 69180 23c188 69179->69180 69180->69127 69181 23c259 69182 3294aa _ValidateLocalCookies 5 API calls 69181->69182 69183 1f11a4 69182->69183 69183->66825 69187 22ba10 69184->69187 69188 22ba70 69187->69188 69189 21b08a 69187->69189 69190 3294e7 __Init_thread_header 6 API calls 69188->69190 69189->69111 69191 22ba7a 69190->69191 69191->69189 69192 32955d __Init_thread_footer 5 API calls 69191->69192 69192->69189 69196 245560 69193->69196 69194 3294aa _ValidateLocalCookies 5 API calls 69195 23bfaf 69194->69195 69195->69118 69195->69119 69196->69194 69232 21ac90 69197->69232 69201 21a249 69200->69201 69202 21a33c 69200->69202 69205 219db0 121 API calls 69201->69205 69206 21a260 69201->69206 69203 1f19a0 121 API calls 69202->69203 69204 21a344 69203->69204 69204->69174 69205->69206 69259 22bb88 69206->69259 69208 21a28f 69209 22bb88 10 API calls 69208->69209 69210 21a2d3 69208->69210 69209->69210 69210->69202 69265 21afea 121 API calls 69210->69265 69213 1f5628 69212->69213 69214 1f5615 69212->69214 69216 1f56ff 69213->69216 69218 1f5651 69213->69218 69215 1f5619 69214->69215 69214->69216 69217 1f567a 69214->69217 69215->69181 69268 230494 23 API calls 69216->69268 69217->69215 69221 3293de 3 API calls 69217->69221 69218->69215 69220 3293de 3 API calls 69218->69220 69220->69215 69221->69215 69222->69128 69223->69139 69225->69138 69226->69148 69227->69160 69228->69164 69229->69168 69230->69176 69231->69145 69234 21acf4 69232->69234 69239 21acd6 69232->69239 69237 21ad0e 69234->69237 69246 219db0 69234->69246 69237->69239 69254 21afea 121 API calls 69237->69254 69240 1f19a0 69239->69240 69241 1f19fa 69240->69241 69242 1f19b5 69240->69242 69241->69166 69242->69241 69255 2190f8 8 API calls 69242->69255 69244 1f19c8 69244->69241 69256 21afea 121 API calls 69244->69256 69247 219deb 69246->69247 69248 219e4b 69246->69248 69257 219fe8 121 API calls 69247->69257 69248->69237 69250 219e43 69251 1f19a0 121 API calls 69250->69251 69251->69248 69252 219e06 69252->69250 69258 21afea 121 API calls 69252->69258 69254->69239 69255->69244 69256->69241 69257->69252 69258->69250 69266 22bb32 9 API calls _ValidateLocalCookies 69259->69266 69261 22bb98 69262 22bbae 69261->69262 69267 22b9d4 RaiseException CallUnexpected 69261->69267 69262->69208 69264 22bbb8 69264->69208 69265->69202 69266->69261 69267->69264 69269->66834 69270->66826 69272 2359b0 69271->69272 69273 2313a0 23 API calls 69272->69273 69276 235a14 69272->69276 69273->69276 69274 3294aa _ValidateLocalCookies 5 API calls 69275 235bc3 69274->69275 69275->66843 69276->69274 69278 235f1d 69277->69278 69286 235c4b 69277->69286 69279 3294aa _ValidateLocalCookies 5 API calls 69278->69279 69280 235904 69279->69280 69280->66846 69289 231a38 23 API calls 69280->69289 69281 2313a0 23 API calls 69281->69286 69282 23225a 23 API calls 69282->69286 69285 235960 23 API calls 69285->69286 69286->69278 69286->69281 69286->69282 69286->69285 69287 231878 23 API calls 69286->69287 69290 231a38 23 API calls 69286->69290 69291 235220 23 API calls 2 library calls 69286->69291 69292 1f7c80 35 API calls 2 library calls 69286->69292 69287->69286 69289->66849 69290->69286 69291->69286 69292->69286 69293->66857 69295 21aba5 69294->69295 69301 21abdb 69294->69301 69298 219db0 121 API calls 69295->69298 69299 21abbc 69295->69299 69296 1f19a0 121 API calls 69297 21ac23 69296->69297 69297->66866 69298->69299 69299->69301 69323 21afea 121 API calls 69299->69323 69301->69296 69303 3428f8 69302->69303 69304 3428db 69302->69304 69303->66875 69304->69303 69305 3428fc 69304->69305 69306 3428e8 69304->69306 69325 342af4 70 API calls 2 library calls 69305->69325 69307 33a7f2 __dosmaperr 11 API calls 69306->69307 69309 3428ed 69307->69309 69324 33be02 22 API calls ___std_exception_copy 69309->69324 69310 34292e 69310->66875 69313 3419b5 69312->69313 69315 3419be 69312->69315 69326 341b06 70 API calls 69313->69326 69317 3419cf 69315->69317 69327 341c8b 70 API calls 2 library calls 69315->69327 69316 3419bb 69316->66880 69317->66880 69319 3419f6 69319->66880 69320->66886 69321->66876 69323->69301 69324->69303 69325->69310 69326->69316 69327->69319 69329 283945 69328->69329 69330 283960 69328->69330 69331 283932 69328->69331 69332 283975 69328->69332 69333 283947 69328->69333 69329->66898 69334 3293de 3 API calls 69330->69334 69336 3293de 3 API calls 69331->69336 69335 3293de 3 API calls 69332->69335 69333->69329 69338 3293de 3 API calls 69333->69338 69339 283967 69334->69339 69340 28397c 69335->69340 69337 283939 69336->69337 69355 2c92c0 GetHandleVerifier CreateEventW GetLastError SetLastError ResetEvent 69337->69355 69343 283998 69338->69343 69356 2cac30 GetHandleVerifier CreateIoCompletionPort GetLastError SetLastError 69339->69356 69357 2c9530 128 API calls _ValidateLocalCookies 69340->69357 69358 2c9530 128 API calls _ValidateLocalCookies 69343->69358 69359 283a00 69346->69359 69348 249e6e 69362 283af0 69348->69362 69350 249e89 69368 28b0a0 69350->69368 69355->69329 69356->69329 69357->69329 69358->69329 69375 24baf0 69359->69375 69363 283b1a 69362->69363 69381 283a50 69363->69381 69366 3294aa _ValidateLocalCookies 5 API calls 69367 283b58 69366->69367 69367->69350 69477 281900 69368->69477 69376 24bb17 69375->69376 69380 24bb10 69375->69380 69377 3294e7 __Init_thread_header 6 API calls 69376->69377 69378 24bb21 69377->69378 69379 32955d __Init_thread_footer 5 API calls 69378->69379 69378->69380 69379->69380 69380->69348 69390 2cb9e0 69381->69390 69384 3293de 3 API calls 69385 283a8a 69384->69385 69395 283be0 69385->69395 69388 3294aa _ValidateLocalCookies 5 API calls 69389 283adf 69388->69389 69389->69366 69391 3293de 3 API calls 69390->69391 69392 2cb9f6 69391->69392 69409 2cb7a0 69392->69409 69397 283c20 69395->69397 69396 283c5c 69415 2839b0 69396->69415 69397->69396 69435 241c30 20 API calls _ValidateLocalCookies 69397->69435 69400 283c94 69418 283de0 69400->69418 69404 283ce3 69406 283cf0 69404->69406 69436 211c60 GetCurrentThreadId 69404->69436 69407 3294aa _ValidateLocalCookies 5 API calls 69406->69407 69408 283ab5 69407->69408 69408->69388 69410 2cb7cb 69409->69410 69411 3293de 3 API calls 69410->69411 69412 2cb7ed 69411->69412 69413 3294aa _ValidateLocalCookies 5 API calls 69412->69413 69414 283a7d 69413->69414 69414->69384 69437 25a910 69415->69437 69419 283e40 69418->69419 69448 2cd500 69419->69448 69421 283f06 69422 3293de 3 API calls 69421->69422 69423 283f7b 69422->69423 69453 2cd920 69423->69453 69425 283f98 69458 289a60 69425->69458 69427 2840a6 69431 2840b8 __fread_nolock 69427->69431 69461 241b20 8 API calls _ValidateLocalCookies 69427->69461 69429 3294aa _ValidateLocalCookies 5 API calls 69430 283cd7 69429->69430 69432 23cde0 69430->69432 69431->69429 69433 3293de 3 API calls 69432->69433 69434 23cdf2 69433->69434 69434->69404 69435->69396 69438 25a956 69437->69438 69446 25a93e 69437->69446 69439 3294e7 __Init_thread_header 6 API calls 69438->69439 69442 25a960 69439->69442 69440 3294aa _ValidateLocalCookies 5 API calls 69441 25a94e 69440->69441 69441->69400 69442->69446 69447 28fdf0 23 API calls 69442->69447 69444 25a974 69445 32955d __Init_thread_footer 5 API calls 69444->69445 69445->69446 69446->69440 69447->69444 69462 2eecb0 69448->69462 69451 2eecb0 3 API calls 69452 2cd54a 69451->69452 69452->69421 69454 3293de 3 API calls 69453->69454 69455 2cd93b 69454->69455 69456 3293de 3 API calls 69455->69456 69457 2cd958 69456->69457 69457->69425 69459 3293de 3 API calls 69458->69459 69460 289a75 69459->69460 69460->69427 69461->69431 69463 3293de 3 API calls 69462->69463 69464 2eecc6 69463->69464 69465 3293de 3 API calls 69464->69465 69466 2eecdc 69465->69466 69467 3293de 3 API calls 69466->69467 69468 2eecf2 69467->69468 69469 3293de 3 API calls 69468->69469 69470 2eed08 69469->69470 69471 3293de 3 API calls 69470->69471 69472 2eed1e 69471->69472 69473 3293de 3 API calls 69472->69473 69474 2eed34 69473->69474 69475 3293de 3 API calls 69474->69475 69476 2cd536 69475->69476 69476->69451 69479 281920 69477->69479 69478 3294e7 __Init_thread_header 6 API calls 69478->69479 69479->69478 69481 32955d __Init_thread_footer 5 API calls 69479->69481 69482 24b630 28 API calls 69479->69482 69481->69479 69482->69479 69525->66943

                                                                                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                                                                                              Function 0026B18D Relevance: 64.3, APIs: 15, Strings: 21, Instructions: 1257threadprocessCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0026B643
                                                                                                                                                                                                                                                                                              • OpenProcess.KERNEL32(001F0FFF,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0026B651
                                                                                                                                                                                                                                                                                              • GetStdHandle.KERNEL32(000000F6), ref: 0026B845
                                                                                                                                                                                                                                                                                              • GetStdHandle.KERNEL32(000000F5), ref: 0026B850
                                                                                                                                                                                                                                                                                              • GetStdHandle.KERNEL32(000000F4), ref: 0026B85B
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0026B9A6
                                                                                                                                                                                                                                                                                              • InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,?,?,?,?,?,?,00000000,003A4F64,00000000), ref: 0026B9D0
                                                                                                                                                                                                                                                                                              • CreateProcessW.KERNELBASE(?,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 0026BAD9
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 0026BAEE
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,003A4F64,00000000), ref: 0026BB5E
                                                                                                                                                                                                                                                                                              • UpdateProcThreadAttribute.KERNEL32(?,00000000,00020002,00000000,?,00000000,00000000,00000008,?,?,?,?,?,00000000,003A4F64,00000000), ref: 0026C27E
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0026C2DC
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0026C30F
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0026C321
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0026C361
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Handle$Process$AttributeCloseInit_thread_footerInit_thread_headerProcThread$CreateCurrentErrorInitializeLastListOpenUpdate
                                                                                                                                                                                                                                                                                              • String ID: --initial-client-data=$../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$::InitializeProcThreadAttributeList$::UpdateProcThreadAttribute$CloseHandle process$CloseHandle thread$CreateProcess$D$InitializeProcThreadAttributeList$InitializeProcThreadAttributeList (size)$InitializeProcThreadAttributeList (size) succeeded, expected failure$OpenProcess$UpdateProcThreadAttribute$annotation$attachment$crash-count-file$database$kernel32.dll$metrics-dir$rundll32.exe$url
                                                                                                                                                                                                                                                                                              • API String ID: 2411058256-4240345948
                                                                                                                                                                                                                                                                                              • Opcode ID: abfd5d9b7fc55dd511ed9787dafc3ec64a8ccabcf037d5d60fa6530a76f9b1e3
                                                                                                                                                                                                                                                                                              • Instruction ID: 90726892ede702953b816d39a96741fcd33ac69fb8ec294a30a1175d1ce632d9
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: abfd5d9b7fc55dd511ed9787dafc3ec64a8ccabcf037d5d60fa6530a76f9b1e3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C2A218B1A143509FD722EF24C841BAFB7E5AFD5700F14492DF889D7281EB71A994CB82
                                                                                                                                                                                                                                                                                              Function 0026F1B4 Relevance: 32.5, APIs: 2, Strings: 16, Instructions: 961COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0026F1F4
                                                                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 0026F980
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileModuleName
                                                                                                                                                                                                                                                                                              • String ID: --monitor-self$--monitor-self-annotation=ptype=$--monitor-self-argument=$--type=$--user-data-dir=$/prefetch:7$OPERA_CRASHPAD_PIPE_NAME$Win32$channel$crashpad-handler$crashpad_handler.exe$plat$prod$special$ver$`6
                                                                                                                                                                                                                                                                                              • API String ID: 514040917-197643805
                                                                                                                                                                                                                                                                                              • Opcode ID: 21b8807369b7cc49a1c08ff7b623e25273ca1dceef83a0355a52864fe14f4401
                                                                                                                                                                                                                                                                                              • Instruction ID: 204d113b27e1170a16aa168939498265b87c09f591fcf9061af243dbbcb34e2e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 21b8807369b7cc49a1c08ff7b623e25273ca1dceef83a0355a52864fe14f4401
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8B8213B1518355AFDB11DF20D841B6BBBE4BF95304F00482EF48A97252DB31EA99CB92
                                                                                                                                                                                                                                                                                              Function 0026ACEE Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 304COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1408 26acee-26acfc 1409 26acfe-26ad05 1408->1409 1410 26ad1a-26ad64 GetCurrentProcessId call 248590 1408->1410 1412 26ad17-26ad19 1409->1412 1413 26ad07-26ad10 call 2ac79e 1409->1413 1418 26ad69-26adc3 call 2ac868 call 230c66 1410->1418 1413->1412 1423 26adc5-26adcb 1418->1423 1424 26add1-26ade8 call 248e60 1418->1424 1423->1424 1427 26adf5-26ae07 1424->1427 1428 26adea-26adf3 1424->1428 1429 26ae1c-26ae4c 1427->1429 1430 26ae09-26ae15 call 32945e 1427->1430 1428->1429 1431 26ae5e-26ae65 1429->1431 1432 26ae4e-26ae5b call 32945e 1429->1432 1430->1429 1435 26ae77-26ae88 call 2acb18 1431->1435 1436 26ae67-26ae74 call 32945e 1431->1436 1432->1431 1443 26ae9f-26aea2 1435->1443 1444 26ae8a-26ae8c 1435->1444 1436->1435 1445 26aea4-26aea8 1443->1445 1446 26aee9-26aef0 1443->1446 1447 26ae92-26ae9d call 2ac794 1444->1447 1448 26b0ca-26b0fb call 33d9b4 call 2acdd8 call 3293de call 2337a0 1444->1448 1445->1418 1449 26aeae-26aee7 call 28d580 call 28d550 call 1f1741 call 28d560 1445->1449 1451 26aef2-26aefa call 32945e 1446->1451 1452 26aefd-26b021 CreateEventW * 3 call 26b0cf SetUnhandledExceptionFilter call 343723 call 3293de call 213450 * 4 call 2304ce call 26c972 call 216204 call 1f4418 call 2313a0 1446->1452 1447->1443 1449->1446 1451->1452 1496 26b023-26b04d CreateThread call 26b0fc 1452->1496 1497 26b0a1-26b0af call 26b18d 1452->1497 1502 26b0b1-26b0c7 call 3294aa 1496->1502 1503 26b04f-26b05b call 23be20 1496->1503 1497->1502 1508 26b093-26b09f 1503->1508 1509 26b05d-26b08e call 23c840 call 23c9e0 call 1f1741 call 23ca90 1503->1509 1508->1502 1509->1508
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 0026AD4F
                                                                                                                                                                                                                                                                                                • Part of subcall function 002AC79E: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,003A4F64,00000000), ref: 002AC7B4
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseCurrentHandleProcess
                                                                                                                                                                                                                                                                                              • String ID: $_6$../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$CreateNamedPipe$CreateThread$\\.\pipe\crashpad_%lu_
                                                                                                                                                                                                                                                                                              • API String ID: 2391145178-693424618
                                                                                                                                                                                                                                                                                              • Opcode ID: 93541a0758e95f429046a8aa2d9092cf550b886a1ce7ac85d7acba69a47a2c98
                                                                                                                                                                                                                                                                                              • Instruction ID: c9114eae430c20ea5e31dc66d3a9023e0550f75966a8e0fbfde561ad1de8c9c1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 93541a0758e95f429046a8aa2d9092cf550b886a1ce7ac85d7acba69a47a2c98
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5EB1CFB1A10704AFD721EF74C881BA6BBE9BF05304F00892EF55A97291EB71B864CB51
                                                                                                                                                                                                                                                                                              Function 0026AD1E Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 284threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1517 26ad1e-26ad64 GetCurrentProcessId call 248590 1520 26ad69-26adc3 call 2ac868 call 230c66 1517->1520 1525 26adc5-26adcb 1520->1525 1526 26add1-26ade8 call 248e60 1520->1526 1525->1526 1529 26adf5-26ae07 1526->1529 1530 26adea-26adf3 1526->1530 1531 26ae1c-26ae4c 1529->1531 1532 26ae09-26ae15 call 32945e 1529->1532 1530->1531 1533 26ae5e-26ae65 1531->1533 1534 26ae4e-26ae5b call 32945e 1531->1534 1532->1531 1537 26ae77-26ae88 call 2acb18 1533->1537 1538 26ae67-26ae74 call 32945e 1533->1538 1534->1533 1545 26ae9f-26aea2 1537->1545 1546 26ae8a-26ae8c 1537->1546 1538->1537 1547 26aea4-26aea8 1545->1547 1548 26aee9-26aef0 1545->1548 1549 26ae92-26ae9d call 2ac794 1546->1549 1550 26b0ca-26b0fb call 33d9b4 call 2acdd8 call 3293de call 2337a0 1546->1550 1547->1520 1551 26aeae-26aee7 call 28d580 call 28d550 call 1f1741 call 28d560 1547->1551 1553 26aef2-26aefa call 32945e 1548->1553 1554 26aefd-26b021 CreateEventW * 3 call 26b0cf SetUnhandledExceptionFilter call 343723 call 3293de call 213450 * 4 call 2304ce call 26c972 call 216204 call 1f4418 call 2313a0 1548->1554 1549->1545 1551->1548 1553->1554 1598 26b023-26b04d CreateThread call 26b0fc 1554->1598 1599 26b0a1-26b0a8 call 26b18d 1554->1599 1604 26b0b1-26b0c7 call 3294aa 1598->1604 1605 26b04f-26b05b call 23be20 1598->1605 1603 26b0ad-26b0af 1599->1603 1603->1604 1610 26b093-26b09f 1605->1610 1611 26b05d-26b08e call 23c840 call 23c9e0 call 1f1741 call 23ca90 1605->1611 1610->1604 1611->1610
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 0026AD4F
                                                                                                                                                                                                                                                                                                • Part of subcall function 00230D4E: _strlen.LIBCMT ref: 00230D5D
                                                                                                                                                                                                                                                                                              • CreateEventW.KERNEL32(0000000C,00000000,00000000,00000000), ref: 0026AF29
                                                                                                                                                                                                                                                                                              • CreateEventW.KERNEL32(0000000C,00000000,00000000,00000000), ref: 0026AF3A
                                                                                                                                                                                                                                                                                              • CreateEventW.KERNEL32(0000000C,00000000,00000000,00000000), ref: 0026AF4B
                                                                                                                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(0026C770), ref: 0026AF5C
                                                                                                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,0026B140,00000000,00000000,00000000), ref: 0026B032
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Create$Event$CurrentExceptionFilterProcessThreadUnhandled_strlen
                                                                                                                                                                                                                                                                                              • String ID: $_6$../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$CreateNamedPipe$CreateThread$\\.\pipe\crashpad_%lu_
                                                                                                                                                                                                                                                                                              • API String ID: 1337974324-693424618
                                                                                                                                                                                                                                                                                              • Opcode ID: 1a0e034623a5f0a36a725a37eca5e9275b5a17b3ab928ef1c119715bdacb41b9
                                                                                                                                                                                                                                                                                              • Instruction ID: 4969f64482fed4910b02dbc7c8a725e69e81a7322dfd9400a557b3acd8afdae4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1a0e034623a5f0a36a725a37eca5e9275b5a17b3ab928ef1c119715bdacb41b9
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6FB1BFB0610700AFD721EF74C885BA6BBE9FF14304F00892EE55A97291EB72B864CF51
                                                                                                                                                                                                                                                                                              Function 0026F782 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 534COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1893 26f782-26f7e4 call 237c80 * 2 call 2373d0 call 217f49 1902 26fb16-26fb3d 1893->1902 1903 26f7ea-26f7ff call 219030 1893->1903 1908 26fb3f-26fb53 call 2701db 1902->1908 1909 26fb6c-26fb6f 1902->1909 1904 26f802-26f804 1903->1904 1906 26f806-26f810 1904->1906 1907 26f83f-26f855 1904->1907 1913 26f812-26f816 1906->1913 1914 26f81a-26f83a call 237cd0 call 237dd0 call 237d90 1906->1914 1925 26f857-26f85e 1907->1925 1926 26f8a1-26f8d1 call 237c80 1907->1926 1923 26fe30 1908->1923 1924 26fb59-26fb67 1908->1924 1911 26fe67-26fe6b 1909->1911 1912 26fbbb-26fbdd call 216204 1909->1912 1915 26fe7c-26fe85 1911->1915 1916 26fe6d 1911->1916 1944 26fbe3-26fc01 call 1f3696 call 2168a0 1912->1944 1945 26fc9f-26fce7 call 1f3696 call 230aa2 call 2168a0 1912->1945 1913->1914 1914->1907 1935 26fe97-26feab 1915->1935 1936 26fe87-26fe90 call 2b1830 1915->1936 1922 26fe74-26fe79 call 32945e 1916->1922 1922->1915 1930 26fe37-26fe52 call 248e60 call 26c3b6 1923->1930 1924->1930 1932 26f860-26f864 1925->1932 1933 26f868-26f89b call 237cd0 call 237dd0 call 237d90 call 252df0 1925->1933 1959 26f8d3-26f8da 1926->1959 1960 26f90a-26f957 call 26f1b4 call 2304ce call 213450 1926->1960 1971 26fe54-26fe5d call 32945e 1930->1971 1972 26fe60 1930->1972 1932->1933 1933->1926 1994 26fed8-26fed9 1933->1994 1947 26feb3-26fed7 call 237d90 call 3294aa 1935->1947 1948 26fead-26feaf 1935->1948 1936->1935 1984 26fc03-26fc0c call 32945e 1944->1984 1985 26fc0f-26fc1f 1944->1985 1996 26fcf5-26fcfa 1945->1996 1997 26fce9-26fcf2 call 32945e 1945->1997 1948->1947 1968 26f8e4-26f905 call 237cd0 call 237dd0 call 237d90 1959->1968 1969 26f8dc-26f8e0 1959->1969 2008 26f95d-26f95f 1960->2008 2009 26f959 1960->2009 1968->1960 1969->1968 1971->1972 1972->1911 1984->1985 1985->1945 1992 26fc21 1985->1992 1999 26fc23-26fc39 call 1f3696 1992->1999 2005 26fedb-26fedc 1994->2005 2003 26fcfc-26fd05 call 32945e 1996->2003 2004 26fd08-26fd40 call 2701db call 26ad1e 1996->2004 1997->1996 2018 26fc40-26fc77 call 230920 call 2168a0 1999->2018 2019 26fc3b-26fc3e 1999->2019 2003->2004 2027 26fd45-26fd67 call 1f573e call 2701db call 26c49e 2004->2027 2014 26f961-26f988 call 32da70 GetModuleFileNameW 2008->2014 2015 26f9cc-26f9e9 call 216204 2008->2015 2009->2008 2014->2005 2032 26f98e-26f997 2014->2032 2030 26fb74-26fbb8 call 238610 call 238b80 call 237dd0 call 237d90 * 2 2015->2030 2031 26f9ef-26fa3b call 1f3696 call 230aa2 call 2168a0 2015->2031 2041 26fc85-26fc8a 2018->2041 2042 26fc79-26fc82 call 32945e 2018->2042 2019->2018 2065 26fd71-26fd90 call 2492e0 2027->2065 2066 26fd69-26fd6d 2027->2066 2030->1912 2072 26fa3d-26fa46 call 32945e 2031->2072 2073 26fa49-26fa51 2031->2073 2037 26f9ab-26f9cb call 237cd0 call 237dd0 call 237d90 2032->2037 2038 26f999 2032->2038 2037->2015 2044 26f99b-26f9a9 2038->2044 2050 26fc8c-26fc95 call 32945e 2041->2050 2051 26fc98-26fc9d 2041->2051 2042->2041 2044->2037 2044->2044 2050->2051 2051->1945 2051->1999 2091 26fd92-26fd9b call 32945e 2065->2091 2092 26fd9e-26fda6 2065->2092 2066->2065 2072->2073 2075 26fa53-26fa5c call 32945e 2073->2075 2076 26fa5f-26fa65 2073->2076 2075->2076 2081 26fa67 2076->2081 2082 26fa6a-26fa6c 2076->2082 2081->2082 2085 26fae2-26fb00 call 1f3696 call 2168a0 2082->2085 2086 26fa6e-26fa82 call 1f3696 2082->2086 2109 26fb02-26fb0b call 32945e 2085->2109 2110 26fb0e-26fb11 2085->2110 2101 26fa84-26fa87 2086->2101 2102 26fa89-26fac1 call 230920 call 2168a0 2086->2102 2091->2092 2093 26fdb4-26fdd7 call 1f40f6 * 2 call 237d90 2092->2093 2094 26fda8-26fdb1 call 32945e 2092->2094 2123 26fde5-26fdf6 call 2010fe 2093->2123 2124 26fdd9-26fde2 call 32945e 2093->2124 2094->2093 2101->2102 2118 26fac3-26facc call 32945e 2102->2118 2119 26facf-26fad4 2102->2119 2109->2110 2110->1912 2118->2119 2119->2085 2122 26fad6-26fadf call 32945e 2119->2122 2122->2085 2132 26fe04-26fe12 call 237d90 2123->2132 2133 26fdf8-26fe01 call 32945e 2123->2133 2124->2123 2138 26fe14-26fe1d call 32945e 2132->2138 2139 26fe20-26fe28 2132->2139 2133->2132 2138->2139 2139->1915 2141 26fe2a-26fe2e 2139->2141 2141->1922
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 0026F980
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileModuleName
                                                                                                                                                                                                                                                                                              • String ID: --monitor-self$--monitor-self-annotation=ptype=$--monitor-self-argument=$--type=$--user-data-dir=$/prefetch:7$OPERA_CRASHPAD_PIPE_NAME$crashpad-handler
                                                                                                                                                                                                                                                                                              • API String ID: 514040917-1229799049
                                                                                                                                                                                                                                                                                              • Opcode ID: e724aaea587615b5871631aeba8216b24806f79934d1c765e6f89671d0f2b618
                                                                                                                                                                                                                                                                                              • Instruction ID: f1d879c3deaf9033f58be75eb5e43bd3cef8f18789692f4b04d36626e8d5d37d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e724aaea587615b5871631aeba8216b24806f79934d1c765e6f89671d0f2b618
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A22F8B05183549FDB21EF20D441BAFBBE4BF95304F04886EF48997252DB31E999CB92
                                                                                                                                                                                                                                                                                              Function 00240EE0 Relevance: 10.8, APIs: 7, Instructions: 319COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 2386 240ee0-240f11 2387 240f17-240f1a 2386->2387 2388 24125d-241271 call 3294e7 2386->2388 2390 240f1c-240f35 call 2533c0 call 3294aa 2387->2390 2391 240f3a-240f49 TryAcquireSRWLockExclusive 2387->2391 2388->2387 2396 241277-2412c1 call 3293de call 2337a0 call 32955d 2388->2396 2416 241173-24117a 2390->2416 2393 240f4f-240f5c 2391->2393 2394 24123b-241242 call 2568f0 2391->2394 2397 240f5e-240f66 2393->2397 2398 240faf-240fb4 2393->2398 2420 241247-241252 call 2568f0 2394->2420 2396->2387 2403 241071-24109c ReleaseSRWLockExclusive call 237c80 2397->2403 2404 240f6c-240fa6 2397->2404 2398->2397 2405 240fb6-240ff0 2398->2405 2424 2410b6-2410bc 2403->2424 2425 24109e-24109f 2403->2425 2409 241000-241004 2404->2409 2410 240fa8-240fad 2404->2410 2412 240ff6-240ffb 2405->2412 2413 24117b-24117f 2405->2413 2418 241011-241019 2409->2418 2421 241006-24100e 2409->2421 2410->2418 2415 24118c-241194 2412->2415 2414 241181-241189 2413->2414 2413->2415 2414->2415 2415->2397 2422 24119a-24119e 2415->2422 2418->2403 2427 24101b-24101f 2418->2427 2439 241152-24115b ReleaseSRWLockExclusive 2420->2439 2440 241258 2420->2440 2421->2418 2422->2397 2430 2411a4-2411aa 2422->2430 2428 2410c1-2410c3 2424->2428 2429 2410be 2424->2429 2432 2410a0 2425->2432 2427->2403 2434 241021-241027 2427->2434 2435 24115d 2428->2435 2436 2410c9-2410d5 call 239e40 2428->2436 2429->2428 2437 2411bf-2411c4 2430->2437 2448 2410a2-2410a7 2432->2448 2441 24103f-241044 2434->2441 2447 24115f-241162 call 237d90 2435->2447 2463 2410d7-2410f9 call 251500 call 237dd0 call 237d90 2436->2463 2464 241102-241117 call 237db0 TryAcquireSRWLockExclusive 2436->2464 2445 2411c6-2411ca 2437->2445 2446 2411b0-2411b3 2437->2446 2439->2447 2440->2388 2442 241046-24104a 2441->2442 2443 241030-241033 2441->2443 2451 241060-241062 2442->2451 2452 24104c-24104f 2442->2452 2449 2411e7-2411eb 2443->2449 2450 241039-24103d 2443->2450 2456 2411d1-2411d3 2445->2456 2457 2411cc-2411cf 2445->2457 2454 2411b5-2411b9 2446->2454 2455 24121f-241236 call 237db0 ReleaseSRWLockExclusive 2446->2455 2467 241167-241171 call 3294aa 2447->2467 2448->2424 2459 2410a9-2410ae 2448->2459 2449->2455 2468 2411ed-24121a call 241520 call 237db0 2449->2468 2450->2403 2450->2441 2460 24106d-24106f 2451->2460 2462 241064-24106a 2451->2462 2452->2460 2454->2397 2454->2437 2455->2467 2465 2411de-2411e0 2456->2465 2466 2411d5-2411db 2456->2466 2457->2465 2459->2424 2469 2410b0-2410b4 2459->2469 2460->2403 2460->2450 2462->2460 2490 2410fe-241100 2463->2490 2491 2410fb 2463->2491 2464->2420 2480 24111d-241121 2464->2480 2465->2454 2474 2411e2 2465->2474 2466->2465 2467->2416 2468->2455 2469->2432 2474->2397 2480->2439 2483 241123-24114f call 241520 call 237db0 2480->2483 2483->2439 2490->2435 2490->2464 2491->2490
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(04D06C28,?,?,?,?,?,?,?,?,?,?,?,001F1118,00000005,?), ref: 00240F41
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(04D06C28,?,?,?,?,?,?,?,?,?,?,?,001F1118,00000005,?), ref: 00241075
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00241262
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 002412B9
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireInit_thread_footerInit_thread_headerRelease
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2580794422-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 95a3203a8b01060053f2fab4a893431bbab3444a238b71eb43769d8d772fe323
                                                                                                                                                                                                                                                                                              • Instruction ID: e0808fc7c7f5a4122ce66da75d2a2d8207b67da5ea7b7add93c7de66717d07a4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 95a3203a8b01060053f2fab4a893431bbab3444a238b71eb43769d8d772fe323
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BDB11771F206599FCF28DF64C8816AEB3B5AF45310F18412DE90AAB341DB31EDA5CB91
                                                                                                                                                                                                                                                                                              Function 00337C65 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(0033D9F7,?,00337D1D,0033C03F,?,0033D9F7,0033C03F,0033D9F7,00000003), ref: 00337C87
                                                                                                                                                                                                                                                                                              • TerminateProcess.KERNEL32(00000000,?,00337D1D,0033C03F,?,0033D9F7,0033C03F,0033D9F7,00000003), ref: 00337C8E
                                                                                                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00337CA0
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1703294689-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 415c17c57b6327db45f28b36853854f688b5a992f639da446166fe96f30372a0
                                                                                                                                                                                                                                                                                              • Instruction ID: 7fbb9575a2eaf068ec4ad2567afccc74f676cda0334acd4321417cc2db583a70
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 415c17c57b6327db45f28b36853854f688b5a992f639da446166fe96f30372a0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CCE0B671014A48AFCF236F68DE89A893B69EB45342F014915F9099A131CB3AED81DB91
                                                                                                                                                                                                                                                                                              Function 002ACB18 Relevance: 3.1, APIs: 2, Instructions: 53pipeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 002ACB49
                                                                                                                                                                                                                                                                                              • CreateNamedPipeW.KERNELBASE ref: 002ACBA4
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateNamedPipeVersion
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1287812050-0
                                                                                                                                                                                                                                                                                              • Opcode ID: e079b294892b1dbb6eef5d32f1c78dda941010b77f360331d1e1b632073544ea
                                                                                                                                                                                                                                                                                              • Instruction ID: 6b8d1ebc21653868ae9d6bb47416cc0f5e5390a8720db2ce90c0b792e37fd571
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e079b294892b1dbb6eef5d32f1c78dda941010b77f360331d1e1b632073544ea
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7911BF718083058FEB049F69D4553AEFBF8EF89304F10882EE899AB350CB715595CBD1
                                                                                                                                                                                                                                                                                              Function 00218004 Relevance: 111.2, APIs: 40, Strings: 23, Instructions: 934COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 00218188
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 00218276
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 002182B3
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 002184E1
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0021860C
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002186F1
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 00218759
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 002183B7
                                                                                                                                                                                                                                                                                                • Part of subcall function 001F3696: _strlen.LIBCMT ref: 001F36AD
                                                                                                                                                                                                                                                                                                • Part of subcall function 00230AA2: _strlen.LIBCMT ref: 00230AAD
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 002187E1
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0021886C
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 00218903
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 00218940
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218A1B
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218A49
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218A5B
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218A89
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218A9B
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218AC9
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218ADB
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218B09
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218B1B
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218B49
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218B5B
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218B89
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218B9B
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: EnterCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 003294F2
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: LeaveCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 0032952F
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218BC9
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218BDB
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218C09
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218C1B
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218C49
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218C5B
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218C8C
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218C9E
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218CCF
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218CE1
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218D0F
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218D21
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218D4F
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00218D61
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00218D8F
                                                                                                                                                                                                                                                                                                • Part of subcall function 0032955D: EnterCriticalSection.KERNEL32(003A4FC0,?,?,0024B5A5,003A4C0C), ref: 00329567
                                                                                                                                                                                                                                                                                                • Part of subcall function 0032955D: LeaveCriticalSection.KERNEL32(003A4FC0,?,?,0024B5A5,003A4C0C), ref: 0032959A
                                                                                                                                                                                                                                                                                                • Part of subcall function 0032955D: WakeAllConditionVariable.KERNEL32(?,0024B5A5,003A4C0C), ref: 0032960D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header$_strlen$CriticalSection$EnterLeave$ConditionCurrentProcessUnothrow_t@std@@@VariableWake__ehfuncinfo$??2@
                                                                                                                                                                                                                                                                                              • String ID: BuildID$Email$InstallTime$OPERA_CRASH_EMAIL$OPERA_CRASH_KEEP_LOGS$OPERA_CRASH_ORIGIN$OPERA_CRASH_REPORTER_OPAUTO_TEST$OPERA_CRASH_SERVER_URL$OpAuto$Origin$ReleaseChannel$UBN$_crashreporter.exe$browser$channel$is_wow64$opauto_test$prod$ptype$symbols-package$user-data-dir$ver$s5
                                                                                                                                                                                                                                                                                              • API String ID: 1984183743-1064767964
                                                                                                                                                                                                                                                                                              • Opcode ID: d0b622541f906651163b1c91eff8691786df9c8d5012e113c56934df30ae2ef8
                                                                                                                                                                                                                                                                                              • Instruction ID: 136cf8d2fabc5d0bf0d66c8e9bb0bd2113b58b9a0d210760bd56e6ca948f011f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0b622541f906651163b1c91eff8691786df9c8d5012e113c56934df30ae2ef8
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EB721CF59183109FDB12EF20EC82AAE77E4EFA6710F040429F94597252DF31A965CB93
                                                                                                                                                                                                                                                                                              Function 002AC8A4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 185pipefileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1333 2ac8a4-2ac8bd 1334 2ac8c3-2ac8c9 1333->1334 1335 2ac8cb 1334->1335 1336 2ac8cd-2ac8f4 CreateFileW 1334->1336 1335->1336 1337 2ac95e-2ac97a SetNamedPipeHandleState 1336->1337 1338 2ac8f6-2ac901 GetLastError 1336->1338 1341 2aca73-2aca7f call 23be20 1337->1341 1342 2ac980-2ac99d TransactNamedPipe 1337->1342 1339 2ac907-2ac90d 1338->1339 1340 2aca25-2aca31 call 23be20 1338->1340 1344 2ac90f 1339->1344 1345 2ac911-2ac91c WaitNamedPipeW 1339->1345 1359 2aca6c-2aca6e 1340->1359 1360 2aca33-2aca57 call 23c840 call 23c9e0 1340->1360 1355 2aca81-2acaaa call 23c840 call 23c9e0 1341->1355 1356 2acaf6 1341->1356 1347 2acaac-2acab8 call 23be20 1342->1347 1348 2ac9a3-2ac9ac 1342->1348 1344->1345 1345->1334 1352 2ac91e-2ac92a call 23be20 1345->1352 1347->1356 1368 2acaba-2acae1 call 23c840 call 23c9e0 1347->1368 1349 2acaf8-2acafe call 2ac794 1348->1349 1350 2ac9b2-2ac9be call 23be20 1348->1350 1369 2acb01-2acb17 call 3294aa 1349->1369 1350->1356 1371 2ac9c4-2aca20 call 23bec0 call 1f1741 call 21a3e0 call 1f1741 call 21a3e0 call 23c2a0 1350->1371 1352->1359 1374 2ac930-2ac959 call 23c840 call 23c9e0 1352->1374 1387 2acae6-2acaf1 call 1f1741 call 23ca90 1355->1387 1356->1349 1359->1369 1389 2aca5c-2aca67 call 1f1741 call 23ca90 1360->1389 1368->1387 1371->1356 1374->1389 1387->1356 1389->1359
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE ref: 002AC8EF
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002AC8F6
                                                                                                                                                                                                                                                                                              • WaitNamedPipeW.KERNEL32(?,000000FF), ref: 002AC914
                                                                                                                                                                                                                                                                                              • SetNamedPipeHandleState.KERNELBASE(00000000,?,00000000,00000000), ref: 002AC972
                                                                                                                                                                                                                                                                                              • TransactNamedPipe.KERNELBASE(00000000,00000000,00000024,0026C428,0000000C,?,00000000), ref: 002AC995
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: NamedPipe$CreateErrorFileHandleLastStateTransactWait
                                                                                                                                                                                                                                                                                              • String ID: , observed $../../third_party/crashpad/crashpad/util/win/registration_protocol_win.cc$CreateFile$SetNamedPipeHandleState$TransactNamedPipe$TransactNamedPipe: expected $WaitNamedPipe
                                                                                                                                                                                                                                                                                              • API String ID: 3582518244-3702053020
                                                                                                                                                                                                                                                                                              • Opcode ID: e508eada60a4646890ffd8421d344ea75a85a2794ba286285aa2217541fa1c40
                                                                                                                                                                                                                                                                                              • Instruction ID: 15bfebff04b5d86ac71ae3d73cdce8b2db6bd93d823b0ba42154928a0b992bc5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e508eada60a4646890ffd8421d344ea75a85a2794ba286285aa2217541fa1c40
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0451F7A1B60318ABEA21FF609C07FBA776D9F45700F504155FA097B2C3DBB15A248A62
                                                                                                                                                                                                                                                                                              Function 0020FBFA Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 357COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1619 20fbfa-20fc26 1620 20fc28-20fc3c call 238b80 1619->1620 1621 20fc3e-20fc42 call 237c80 1619->1621 1625 20fc47-20fc51 1620->1625 1621->1625 1626 20fc53 1625->1626 1627 20fc57-20fc59 1625->1627 1626->1627 1628 20fc8a-20fc90 1627->1628 1629 20fc5b-20fc67 call 238b80 1627->1629 1630 20fc92-20fca4 1628->1630 1631 20fcb5-20fccb call 237c80 call 240ee0 1628->1631 1636 20fc6c-20fc89 call 237d90 call 3294aa 1629->1636 1633 20fe29 1630->1633 1634 20fcaa-20fcb0 1630->1634 1644 20fcd0-20fcd5 1631->1644 1638 20fe2c-20fe6a call 249420 call 3442d0 call 249420 1633->1638 1634->1638 1660 20fe78-20fe9a 1638->1660 1661 20fe6c-20fe74 1638->1661 1647 20ff35-20ff37 call 237c80 1644->1647 1648 20fcdb-20fd03 call 1f3696 call 212c10 1644->1648 1653 20ff3c-20ff45 call 237d90 1647->1653 1663 20fd05-20fd0b call 3442d0 1648->1663 1664 20fd0e-20fd2b call 247bc0 call 212ccb 1648->1664 1671 20ff4a-20ff4e 1653->1671 1665 20fea0-20feba 1660->1665 1666 20ff6e-20ff87 call 20f8e0 1660->1666 1661->1660 1663->1664 1695 20fd38-20fd63 call 247bc0 call 20f9f0 1664->1695 1696 20fd2d-20fd36 call 3442d0 1664->1696 1668 20fec4-20fed7 1665->1668 1669 20febc-20febf 1665->1669 1684 20ff89-20ff90 1666->1684 1685 20ffca-20ffcf call 237c80 1666->1685 1675 20feda-20fedf 1668->1675 1674 20ffc4-20ffc8 1669->1674 1677 20ff50-20ff66 1671->1677 1678 20ffb9-20ffc0 1671->1678 1680 21000a-21001c call 237cd0 1674->1680 1675->1678 1681 20fee5 1675->1681 1677->1680 1683 20ff6c 1677->1683 1678->1674 1697 210021-210026 1680->1697 1687 20fee6-20fee9 1681->1687 1683->1666 1690 20ff92 1684->1690 1691 20ff96-20ffb7 call 231ea8 1684->1691 1692 20ffd4-20ffdd 1685->1692 1693 20fef8-20feff 1687->1693 1694 20feeb-20fef1 1687->1694 1690->1691 1691->1692 1700 20ffef-20fff1 1692->1700 1701 20ffdf-20ffec call 32945e 1692->1701 1704 20ff00-20ff02 1693->1704 1694->1687 1702 20fef3 1694->1702 1723 20fd65-20fd69 1695->1723 1724 20fd6d-20fd85 call 247bc0 1695->1724 1696->1695 1706 210034-210039 1697->1706 1707 210028-210031 call 32945e 1697->1707 1700->1697 1710 20fff3-210006 1700->1710 1701->1700 1702->1678 1704->1671 1712 20ff04-20ff1a 1704->1712 1706->1636 1708 21003f-21004b call 32945e 1706->1708 1707->1706 1708->1636 1710->1680 1712->1704 1718 20ff1c-20ff2e 1712->1718 1718->1675 1722 20ff30 1718->1722 1722->1678 1723->1724 1727 20fd93-20fdb7 1724->1727 1728 20fd87-20fd90 call 32945e 1724->1728 1730 20fdd5-20fe12 call 239d80 call 237dd0 call 237d90 call 237ca0 1727->1730 1731 20fdb9-20fdbc 1727->1731 1728->1727 1730->1653 1744 20fe18-20fe24 call 32945e 1730->1744 1733 20fdc1-20fdc4 1731->1733 1734 20fdbe 1731->1734 1733->1731 1736 20fdc6-20fdd2 1733->1736 1734->1733 1736->1730 1744->1653
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0020FD06
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0020FD2E
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0020FE4D
                                                                                                                                                                                                                                                                                                • Part of subcall function 0020F8E0: GetUserNameW.ADVAPI32(?,?), ref: 0020F91D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen$NameUser
                                                                                                                                                                                                                                                                                              • String ID: <USERNAME>$data$profile${CompanyName}${CompanyName}/{ProductName} {InternalStream}${InternalStream}${ProductName}
                                                                                                                                                                                                                                                                                              • API String ID: 1881245836-2942531514
                                                                                                                                                                                                                                                                                              • Opcode ID: 225734daf2e444fc9c75bb223839aa9655fc03a2fe29c404ec3f6fcd07d81732
                                                                                                                                                                                                                                                                                              • Instruction ID: e6358c0c8073112508e4da2b4db56d8182aa7b73de5c0016cb7e23a6d97ae048
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 225734daf2e444fc9c75bb223839aa9655fc03a2fe29c404ec3f6fcd07d81732
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6BD1F1B1528351ABDB21DF10C881A6FFBE4AFD2704F04482EF8C457682D771E969CB92
                                                                                                                                                                                                                                                                                              Function 0023BF60 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 265timeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1747 23bf60-23bf8b 1748 23bf98 1747->1748 1749 23bf8d-23bf96 call 3442d0 1747->1749 1751 23bf9a-23bfb5 call 245530 1748->1751 1749->1751 1755 23bfb7-23bfbd 1751->1755 1756 23bfd6 1751->1756 1757 23bfc3-23bfd4 1755->1757 1758 23c295-23c298 1755->1758 1759 23bfda-23c004 call 1f1741 1756->1759 1757->1759 1762 23c006-23c028 call 3442d0 call 1f1741 * 2 1759->1762 1763 23c02b-23c034 1759->1763 1762->1763 1765 23c036-23c05b call 276720 call 276700 call 1f1741 1763->1765 1766 23c05e-23c069 1763->1766 1765->1766 1769 23c06b-23c086 call 211c60 call 21a3e0 call 1f1741 1766->1769 1770 23c089-23c090 1766->1770 1769->1770 1773 23c096-23c188 GetLocalTime call 21a020 * 2 call 1f1741 call 21a020 * 3 call 1f1741 call 21a020 call 1f1741 1770->1773 1774 23c18b-23c192 1770->1774 1773->1774 1779 23c1b5-23c1ba 1774->1779 1780 23c194-23c1b2 GetTickCount call 21a7a0 call 1f1741 1774->1780 1782 23c1eb-23c203 call 1f1741 call 21a200 1779->1782 1783 23c1bc-23c1c6 1779->1783 1780->1779 1810 23c208-23c260 call 1f1741 call 244e00 call 1f1741 call 21a200 call 1f1741 call 1f5604 1782->1810 1790 23c1c8 1783->1790 1791 23c1cf-23c1e9 call 3442d0 call 1f1741 1783->1791 1790->1791 1791->1810 1836 23c262-23c268 1810->1836 1837 23c26a-23c27d call 32945e 1810->1837 1839 23c280-23c292 call 3294aa 1836->1839 1837->1839
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0023BF8E
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0023C007
                                                                                                                                                                                                                                                                                              • GetLocalTime.KERNEL32(0000005B,?,?,?,?,?,?,?,00000198,?,?,0023BF52,00000198,?,?), ref: 0023C0A1
                                                                                                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 0023C194
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0023C1D0
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen$CountLocalTickTime
                                                                                                                                                                                                                                                                                              • String ID: )] $:$:$UNKNOWN$VERBOSE
                                                                                                                                                                                                                                                                                              • API String ID: 3535325690-776901039
                                                                                                                                                                                                                                                                                              • Opcode ID: 8acecb1d7209379cfa07ebfa77eb699c9ca405c619c12d2013d2f860255dbe2a
                                                                                                                                                                                                                                                                                              • Instruction ID: f840ae0689a342a3c1f7286d2f7cb1df261347302d4f51c2e4de9d6e28b44193
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8acecb1d7209379cfa07ebfa77eb699c9ca405c619c12d2013d2f860255dbe2a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3291D4F0A14300AFD711FF20DC86F3BBBE9AB95714F04491CF98957282EB75A9148B62
                                                                                                                                                                                                                                                                                              Function 002ACBC3 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 1843 2acbc3-2acbe7 call 2acf00 1846 2acbed-2acc08 1843->1846 1847 2acdd2-2acdd7 1843->1847 1848 2acc0a-2acc15 1846->1848 1849 2acc4c-2acc60 call 3294e7 1846->1849 1851 2acc17-2acc19 1848->1851 1852 2acc25-2acc2c 1848->1852 1849->1848 1858 2acc62-2acc87 ConvertStringSecurityDescriptorToSecurityDescriptorW 1849->1858 1854 2acc1b-2acc23 1851->1854 1855 2acc34-2acc4b call 3294aa 1851->1855 1852->1855 1856 2acc2e 1852->1856 1854->1855 1856->1855 1860 2acc8d-2accfd BuildExplicitAccessWithNameW BuildSecurityDescriptorW 1858->1860 1861 2acd55-2acd61 call 23be20 1858->1861 1863 2acd9a-2acda3 1860->1863 1864 2acd03-2acd18 SetLastError call 23be20 1860->1864 1868 2acdba-2acdcd call 32955d 1861->1868 1870 2acd63-2acd98 call 23c840 call 23c9e0 call 1f1741 call 23ca90 1861->1870 1865 2acda7-2acdac 1863->1865 1864->1865 1875 2acd1e-2acd53 call 23c840 call 23c9e0 call 1f1741 call 23ca90 1864->1875 1865->1868 1869 2acdae-2acdb7 call 2d6608 1865->1869 1868->1848 1869->1868 1870->1868 1875->1865
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 002ACC51
                                                                                                                                                                                                                                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GWGR;;;S-1-15-2-1)S:(ML;;;;;S-1-16-0),00000001,?,00000000), ref: 002ACC80
                                                                                                                                                                                                                                                                                              • BuildExplicitAccessWithNameW.ADVAPI32(?,?,10000000,00000001,00000000), ref: 002ACCD1
                                                                                                                                                                                                                                                                                              • BuildSecurityDescriptorW.ADVAPI32(00000000,00000000,00000001,?,00000000,00000000,?,?,?), ref: 002ACCF5
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 002ACD04
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 002ACDC5
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • BuildSecurityDescriptor, xrefs: 002ACD3E
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/win/registration_protocol_win.cc, xrefs: 002ACD2E, 002ACD73
                                                                                                                                                                                                                                                                                              • D:(A;;GA;;;SY)(A;;GWGR;;;S-1-15-2-1)S:(ML;;;;;S-1-16-0), xrefs: 002ACC7B
                                                                                                                                                                                                                                                                                              • ConvertStringSecurityDescriptorToSecurityDescriptor, xrefs: 002ACD83
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: DescriptorSecurity$Build$AccessConvertErrorExplicitInit_thread_footerInit_thread_headerLastNameStringWith
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/win/registration_protocol_win.cc$BuildSecurityDescriptor$ConvertStringSecurityDescriptorToSecurityDescriptor$D:(A;;GA;;;SY)(A;;GWGR;;;S-1-15-2-1)S:(ML;;;;;S-1-16-0)
                                                                                                                                                                                                                                                                                              • API String ID: 1468532445-440191626
                                                                                                                                                                                                                                                                                              • Opcode ID: 9b893f528229979e0e55a14fdde08a67391121891886e8074d5ea74b6f6a5066
                                                                                                                                                                                                                                                                                              • Instruction ID: 975e33a420ff7a48a2ca18f465f3e698bf20931203e8f98968a065af0f66ae68
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9b893f528229979e0e55a14fdde08a67391121891886e8074d5ea74b6f6a5066
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 715159B0920740ABDB22DF24DC06FAB77ACEFC6710F10452AF9895B291EF709810CB52
                                                                                                                                                                                                                                                                                              Function 0033C5CC Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 2144 33c5cc-33c5fc call 33ca4c 2147 33c617-33c623 call 33b457 2144->2147 2148 33c5fe-33c609 call 33a805 2144->2148 2154 33c625-33c63a call 33a805 call 33a7f2 2147->2154 2155 33c63c-33c670 call 33c9b7 2147->2155 2153 33c60b-33c612 call 33a7f2 2148->2153 2165 33c8f1-33c8f5 2153->2165 2154->2153 2160 33c675-33c685 2155->2160 2163 33c6f2-33c6fb GetFileType 2160->2163 2164 33c687-33c690 2160->2164 2166 33c744-33c747 2163->2166 2167 33c6fd-33c72e GetLastError call 33a818 CloseHandle 2163->2167 2169 33c692-33c696 2164->2169 2170 33c6c7-33c6ed GetLastError call 33a818 2164->2170 2172 33c750-33c756 2166->2172 2173 33c749-33c74e 2166->2173 2167->2153 2181 33c734-33c73f call 33a7f2 2167->2181 2169->2170 2174 33c698-33c6c5 call 33c9b7 2169->2174 2170->2153 2177 33c75a-33c7a8 call 33b5fb 2172->2177 2178 33c758 2172->2178 2173->2177 2174->2163 2174->2170 2187 33c7c7-33c7ef call 33cc70 2177->2187 2188 33c7aa-33c7b6 call 33cbc6 2177->2188 2178->2177 2181->2153 2194 33c7f1-33c7f2 2187->2194 2195 33c7f4-33c835 2187->2195 2188->2187 2193 33c7b8 2188->2193 2196 33c7ba-33c7c2 call 338191 2193->2196 2194->2196 2197 33c837-33c83b 2195->2197 2198 33c856-33c864 2195->2198 2196->2165 2197->2198 2200 33c83d-33c851 2197->2200 2201 33c86a-33c86e 2198->2201 2202 33c8ef 2198->2202 2200->2198 2201->2202 2204 33c870-33c8a3 CloseHandle call 33c9b7 2201->2204 2202->2165 2207 33c8d7-33c8eb 2204->2207 2208 33c8a5-33c8d1 GetLastError call 33a818 call 33b56a 2204->2208 2207->2202 2208->2207
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0033C9B7: CreateFileW.KERNELBASE(00000000,00000000,?,0033C675,?,?,00000000,?,0033C675,00000000,0000000C), ref: 0033C9D4
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0033C6E0
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 0033C6E7
                                                                                                                                                                                                                                                                                              • GetFileType.KERNEL32(00000000), ref: 0033C6F3
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0033C6FD
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 0033C706
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0033C726
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0033C873
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0033C8A5
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 0033C8AC
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4237864984-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c65c9a0c46d6f04f7db28b99229f31b302ecd8e82187d1ba1e74d864e7f2ec74
                                                                                                                                                                                                                                                                                              • Instruction ID: 6d1e47364ce910ffb46c8faf44a5ac987df1596fcf5dbba4a0c1688da561fede
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c65c9a0c46d6f04f7db28b99229f31b302ecd8e82187d1ba1e74d864e7f2ec74
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 61A13732A241549FCF1B9F68CCD27AD3BA5AB46324F191259E811BF391CB358D02CB92
                                                                                                                                                                                                                                                                                              Function 00234020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 186libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 2213 234020-234051 call 246f20 2216 234057-23407d LoadLibraryExW 2213->2216 2217 23421b-23422c call 3294aa 2213->2217 2218 23409a-23409f CommandLineToArgvW 2216->2218 2219 23407f-23408d GetProcAddress 2216->2219 2223 2340a5-2340a7 2218->2223 2221 2340a9 2219->2221 2222 23408f-234098 2219->2222 2225 2340ab-2340c5 2221->2225 2222->2223 2223->2225 2227 2341b1-2341d2 call 233c40 LocalFree 2225->2227 2228 2340cb-2340d6 2225->2228 2237 2341d4-2341d5 FreeLibrary 2227->2237 2238 2341db-2341e0 2227->2238 2229 23423b-234243 call 23297c 2228->2229 2230 2340dc-234100 call 3293de 2228->2230 2239 234145-234170 call 344504 2230->2239 2237->2238 2238->2217 2240 2341e2-2341e7 2238->2240 2250 234176-23417b 2239->2250 2251 23422f-234231 call 230494 2239->2251 2241 2341f6-2341fd 2240->2241 2242 2341e9-2341eb 2240->2242 2245 2341f0-2341f4 2241->2245 2246 2341ff-23420a call 32945e 2241->2246 2244 23420f-234218 call 32945e 2242->2244 2244->2217 2245->2241 2248 23420c 2245->2248 2246->2245 2248->2244 2254 234110-234117 2250->2254 2255 23417d-234183 2250->2255 2258 234236 call 33d9b4 2251->2258 2260 234131-234143 2254->2260 2261 234119-23412e call 32cf70 2254->2261 2255->2258 2259 234189-2341a3 call 3293de 2255->2259 2258->2229 2259->2261 2260->2239 2263 2341a8-2341ae 2260->2263 2261->2260 2263->2227
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32(api-ms-win-downlevel-shell32-l1-1-0.dll,00000000,00000800,?,?,?,?,?,?,?,?,00000000,04CFF3E8), ref: 00234072
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,CommandLineToArgvW), ref: 00234085
                                                                                                                                                                                                                                                                                              • CommandLineToArgvW.SHELL32(?,00000000,?,?,?,?,?,?,?,?,00000000,04CFF3E8), ref: 0023409F
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(00000000,?), ref: 002341C7
                                                                                                                                                                                                                                                                                              • FreeLibrary.KERNELBASE(?), ref: 002341D5
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • api-ms-win-downlevel-shell32-l1-1-0.dll, xrefs: 0023406D
                                                                                                                                                                                                                                                                                              • CommandLineToArgvW, xrefs: 0023407F
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FreeLibrary$AddressArgvCommandLineLoadLocalProc
                                                                                                                                                                                                                                                                                              • String ID: CommandLineToArgvW$api-ms-win-downlevel-shell32-l1-1-0.dll
                                                                                                                                                                                                                                                                                              • API String ID: 787947344-3353834106
                                                                                                                                                                                                                                                                                              • Opcode ID: 35eed818ad73d80588af7344035eeb6615b7e0d3f3486bffd5013abf94cda78a
                                                                                                                                                                                                                                                                                              • Instruction ID: 1fe4cf470d7b2828e74ad8cf1ee313028eb1b8a1ae82eee227a4bdb53ed8c6d7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 35eed818ad73d80588af7344035eeb6615b7e0d3f3486bffd5013abf94cda78a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE51A1F1E206199FDB01EFA4DC457AFBBB8BF18310F14416AE805BB240D775A915CBA1
                                                                                                                                                                                                                                                                                              Function 0026FF91 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 167COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 2268 26ff91-26ffb2 2269 26ffb7-26fff0 call 26f782 call 2ac50c 2268->2269 2270 26ffb4 2268->2270 2275 26fff2-26fffa 2269->2275 2276 27000d-270014 2269->2276 2270->2269 2278 270001-270009 2275->2278 2279 26fffc-26ffff 2275->2279 2277 270019 2276->2277 2280 27001b-27004e call 32cf70 call 2ac768 GetCurrentProcessId call 243aa0 2277->2280 2278->2277 2281 27000b 2278->2281 2279->2278 2288 270056-27007f call 32cf70 call 2ac768 2280->2288 2289 270050-270053 2280->2289 2281->2280 2294 270081-270089 call 32945e 2288->2294 2295 27008c-27009e call 271ee0 2288->2295 2289->2288 2294->2295 2300 2700a6-2700cf call 32cf70 call 2ac768 2295->2300 2301 2700a0-2700a3 2295->2301 2306 2700d1-2700d9 call 32945e 2300->2306 2307 2700dc-2700fa call 23beb0 call 28c3a0 2300->2307 2301->2300 2306->2307 2314 270166-27017f call 237d90 call 3294aa 2307->2314 2315 2700fc-270157 call 3293de call 213450 call 2b7b42 call 217f49 call 270242 call 2b880a 2307->2315 2333 27015c-270163 call 270353 2315->2333 2333->2314
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(00000007,?,?,?,?,?,?,?,?,?,?,?,?,?,002701BF,?), ref: 00270035
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                                                                              • String ID: 0 :$0 :$5768$asstgx_ins$browser$x86_64
                                                                                                                                                                                                                                                                                              • API String ID: 2050909247-544296015
                                                                                                                                                                                                                                                                                              • Opcode ID: 7d576a4f88114a17dff977ade86d849a42e5c43294a705375bb827c1e85f41ce
                                                                                                                                                                                                                                                                                              • Instruction ID: 75814c83d4eca3eebf3a4507566a5e2b201643fd3a21196e9f535b36bfa245e6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7d576a4f88114a17dff977ade86d849a42e5c43294a705375bb827c1e85f41ce
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 43512CB2E102149BDF11AFA59C41AFF7BF59F96310F048035F849A7242DA35A928CFA1
                                                                                                                                                                                                                                                                                              Function 0023BA00 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 125fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 2336 23ba00-23ba28 call 234250 call 234730 2341 23ba2a-23ba38 call 234730 2336->2341 2342 23ba3e-23ba45 2336->2342 2341->2342 2349 23bad0-23bade 2341->2349 2343 23bb9b-23bb9f 2342->2343 2344 23ba4b-23bac8 call 3293de call 3442d0 call 2347a0 call 3442d0 call 2347a0 call 276090 2342->2344 2379 23bb11-23bb20 call 32945e 2344->2379 2380 23baca-23bace 2344->2380 2351 23bb87-23bb9a call 3294aa 2349->2351 2352 23bae4-23baeb 2349->2352 2353 23bb2f-23bb37 2352->2353 2354 23baed-23bb06 CloseHandle 2352->2354 2358 23bb5e-23bb6a call 231bbc 2353->2358 2361 23bb39-23bb59 call 3293de 2353->2361 2357 23bb08-23bb0f 2354->2357 2354->2358 2357->2361 2369 23bb80 call 23bba0 2358->2369 2370 23bb6c-23bb75 2358->2370 2361->2358 2375 23bb85 2369->2375 2371 23bb77 2370->2371 2372 23bb79-23bb7a DeleteFileW 2370->2372 2371->2372 2372->2369 2375->2351 2379->2349 2382 23bb22-23bb2d call 32945e 2379->2382 2380->2349 2380->2382 2382->2349
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00234730: _strlen.LIBCMT ref: 00234751
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0023BA6D
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0023BA93
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(000002A8,j6), ref: 0023BAEE
                                                                                                                                                                                                                                                                                              • DeleteFileW.KERNEL32(04D114D0,?,j6), ref: 0023BB7A
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen$CloseDeleteFileHandle
                                                                                                                                                                                                                                                                                              • String ID: vmodule$j6$j6
                                                                                                                                                                                                                                                                                              • API String ID: 1068956878-4268788946
                                                                                                                                                                                                                                                                                              • Opcode ID: 06365ea783a5058ba6872d1a552264663f4a5c83439e42d118c656c06fd43757
                                                                                                                                                                                                                                                                                              • Instruction ID: 0b6c35057b9d39b086e03b337e8ca80856fef7d7e3ea62878ab121a19cb0c907
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 06365ea783a5058ba6872d1a552264663f4a5c83439e42d118c656c06fd43757
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE41F9F0E202085FEF12DF64EC56BAEBBB9EB45314F004069F9069B291EB719954CB91
                                                                                                                                                                                                                                                                                              Function 001F1000 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 00233F70: GetCommandLineW.KERNEL32(?,00000000), ref: 00233FE7
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 001F1055
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CommandLine_strlen
                                                                                                                                                                                                                                                                                              • String ID: ../../opera/desktop/windows/assistant/installer/assistant_installer_main.cc$Running assistant installer with command line $WinMain$assistant_installer_%02d%02d%02d%02d%02d%02d.log$asstgx_ins
                                                                                                                                                                                                                                                                                              • API String ID: 1507289288-2816526336
                                                                                                                                                                                                                                                                                              • Opcode ID: dfb85fbbfd958251156a96ba16229c879f8e3e2419ee7c8bdfc78748dd1fdce0
                                                                                                                                                                                                                                                                                              • Instruction ID: 753f14da5a8712277010f88eb531e94e8860732dce2502eefb8eb09437af3014
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dfb85fbbfd958251156a96ba16229c879f8e3e2419ee7c8bdfc78748dd1fdce0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8091E6B1910704ABD725EF30DC82B77B7E5AF94300F04492DFA8A97642EB71B568CB91
                                                                                                                                                                                                                                                                                              Function 0023BBA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 176fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 2596 23bba0-23bbbf 2597 23bdf6-23be0c call 3294aa 2596->2597 2598 23bbc5-23bbcd 2596->2598 2599 23bbe1-23bc36 call 3293de call 32da70 GetModuleFileNameW call 344504 2598->2599 2600 23bbcf-23bbd6 2598->2600 2618 23be0d-23be0f call 230494 2599->2618 2619 23bc3c-23bc41 2599->2619 2602 23bcdb-23bcdf 2600->2602 2603 23bbdc 2600->2603 2606 23bce3-23bd16 CreateFileW 2602->2606 2607 23bce1 2602->2607 2603->2597 2606->2597 2609 23bd1c-23bd52 call 32da70 GetCurrentDirectoryW 2606->2609 2607->2606 2615 23bdf4 2609->2615 2616 23bd58-23bd5d 2609->2616 2615->2597 2616->2615 2620 23bd63-23bd7b call 231bbc 2616->2620 2625 23be14-23be19 call 33d9b4 2618->2625 2621 23bc43-23bc4a 2619->2621 2622 23bc4e-23bc54 2619->2622 2634 23bd81-23bd83 2620->2634 2635 23bd7d-23bd7f 2620->2635 2626 23bc7a-23bc8a call 32cf70 2621->2626 2627 23bc4c 2621->2627 2622->2625 2628 23bc5a-23bc74 call 3293de 2622->2628 2631 23bc8d-23bc99 2626->2631 2627->2631 2628->2626 2640 23bc9b 2631->2640 2641 23bc9e-23bcad call 2320c2 2631->2641 2636 23bd86-23bd8c 2634->2636 2635->2636 2642 23bd9e-23bdb1 call 231a38 2636->2642 2643 23bd8e-23bd98 call 231a38 2636->2643 2640->2641 2650 23bcaf-23bcb7 call 231dd6 2641->2650 2651 23bcbc-23bcd5 call 231a38 2641->2651 2654 23bdb3 2642->2654 2655 23bdb5-23bde8 CreateFileW 2642->2655 2643->2642 2650->2651 2651->2597 2651->2602 2654->2655 2655->2597 2657 23bdea 2655->2657 2657->2615
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0023BC0E
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE ref: 0023BD05
                                                                                                                                                                                                                                                                                              • GetCurrentDirectoryW.KERNEL32(00000104,00000000,?,?,?,?,?,?,?,debug.log,0000005C,?), ref: 0023BD4A
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNEL32 ref: 0023BDD7
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: File$Create$CurrentDirectoryModuleName
                                                                                                                                                                                                                                                                                              • String ID: debug.log
                                                                                                                                                                                                                                                                                              • API String ID: 4120427848-600467936
                                                                                                                                                                                                                                                                                              • Opcode ID: 99e660dc3b8fb79185a217da6729e789298ffb636c80b1d9618db1dcd1ccfc32
                                                                                                                                                                                                                                                                                              • Instruction ID: 0bc26b351bbe2e1e265ec7c4abad9a35f4aa5088d491d03a3ee36cfcf97dd679
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99e660dc3b8fb79185a217da6729e789298ffb636c80b1d9618db1dcd1ccfc32
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 57518BF0A143059FE7229F24DC8ABAB7BB8AF42704F10451DF6459B2E1DB709998CBD1
                                                                                                                                                                                                                                                                                              Function 0023C2A0 Relevance: 7.8, APIs: 5, Instructions: 326COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                                                                                              control_flow_graph 2658 23c2a0-23c391 call 219eb8 call 22bb88 call 21cc00 call 21ab60 call 219db0 call 1f5604 2674 23c6a2-23c6b9 2658->2674 2675 23c397-23c456 call 32ea2f call 3428cd call 32ea2f call 3419a3 2658->2675 2678 23c833-23c836 2674->2678 2679 23c6bf-23c789 call 3293de call 2792a0 call 211c60 call 259c70 call 25ecc0 2674->2679 2699 23c493-23c497 2675->2699 2679->2675 2706 23c7bd-23c7d1 call 3294e7 2679->2706 2701 23c4c9-23c4cd 2699->2701 2702 23c499-23c4a7 2699->2702 2707 23c62d-23c631 2701->2707 2704 23c4d2-23c4ed call 32da70 2702->2704 2705 23c4a9-23c4c2 call 278870 2702->2705 2718 23c4f5 2704->2718 2719 23c4ef-23c4f3 2704->2719 2705->2701 2722 23c532-23c53d 2706->2722 2723 23c7d7-23c7f0 call 32955d 2706->2723 2709 23c633-23c63c call 32945e 2707->2709 2710 23c63f-23c666 call 2766e0 2707->2710 2709->2710 2726 23c673-23c6a1 call 219a44 call 1fce50 call 219a3a call 3294aa 2710->2726 2727 23c668-23c670 call 32945e 2710->2727 2725 23c4f9-23c52c call 247ee0 call 1fce50 2718->2725 2719->2725 2728 23c543-23c568 2722->2728 2729 23c82d-23c82e 2722->2729 2723->2722 2725->2706 2725->2722 2727->2726 2734 23c7f5-23c809 call 3294e7 2728->2734 2735 23c56e-23c583 2728->2735 2736 23c830-23c831 2729->2736 2734->2735 2746 23c80f-23c828 call 32955d 2734->2746 2735->2736 2741 23c589-23c5a2 call 233980 2735->2741 2736->2678 2752 23c620-23c629 call 233960 2741->2752 2753 23c5a4-23c5b0 2741->2753 2746->2735 2752->2707 2757 23c5b2-23c5b6 2753->2757 2758 23c5b8 2753->2758 2759 23c5bc-23c5c8 2757->2759 2758->2759 2762 23c5d5 2759->2762 2763 23c5ca-23c5d3 call 3442d0 2759->2763 2766 23c5d7-23c61c 2762->2766 2763->2766 2766->2752
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                                                                                              • Opcode ID: bb66de8ea401d2628ca527b3d15979aaffb628a305381dd0a4079228bd80570d
                                                                                                                                                                                                                                                                                              • Instruction ID: 6eb1461d87d822a6758d2a58eabb65837404b3b429f5426fd97624f3361c27f6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bb66de8ea401d2628ca527b3d15979aaffb628a305381dd0a4079228bd80570d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 52C1E1B1A183419FD711DF24D881A2AB7F4AFCA314F108A1DF99967292D770EA15CB82
                                                                                                                                                                                                                                                                                              Function 00259A00 Relevance: 7.7, APIs: 5, Instructions: 177timeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SystemFunction036.ADVAPI32(FFFFFFFF,FFFFFFFF,?,00241BE8,?,00000008,000000FF), ref: 00259A0E
                                                                                                                                                                                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00259A76
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00259A88
                                                                                                                                                                                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00259B1E
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00259B2C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Time$System$FileUnothrow_t@std@@@__ehfuncinfo$??2@$Function036
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2980182385-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c762b03a16c80f1e8905a3167929acc0f188cce4145d39fc2172a7c3f59a14ea
                                                                                                                                                                                                                                                                                              • Instruction ID: 9714f177d488138a09754fc2f6d2b7bd2e240841e88e603da964f9aa62113223
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c762b03a16c80f1e8905a3167929acc0f188cce4145d39fc2172a7c3f59a14ea
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D56192756093019FC711CF68D88171A7BE9BBC9720F158B2DF8A8873A0D7719949CB92
                                                                                                                                                                                                                                                                                              Function 001F5E80 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 244COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID: Internet Browser$,/:
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-2836438048
                                                                                                                                                                                                                                                                                              • Opcode ID: 09a5cc4add4bcef99ea9b507313df1abc50c2c12546bb32fd0ffcae576dcb088
                                                                                                                                                                                                                                                                                              • Instruction ID: 2ab822d70ca2680a8250f1229084e87000a1e6d7b756327e797233c116308ea9
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 09a5cc4add4bcef99ea9b507313df1abc50c2c12546bb32fd0ffcae576dcb088
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 88A1F0B0D04648AFEB12DBA0D845BFFBBF1AF05304F04405AF54A6B252DB71A959CBA1
                                                                                                                                                                                                                                                                                              Function 002B5423 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 130COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNELBASE(00000004), ref: 002B5446
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AttributesFile
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc$: not a directory$GetFileAttributes
                                                                                                                                                                                                                                                                                              • API String ID: 3188754299-3496458271
                                                                                                                                                                                                                                                                                              • Opcode ID: 98c875c2f3dd7ebe9700cc10629c9f5f79609ec33cd9774acc7c4f678843a852
                                                                                                                                                                                                                                                                                              • Instruction ID: 7363917297fa2ed51cb3c8c0697f22cd36cf422b9bf5b8550d4122488d10c253
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 98c875c2f3dd7ebe9700cc10629c9f5f79609ec33cd9774acc7c4f678843a852
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D741F8B1A50228AAFB21BF10DC46FEAB7695F10340F4440A5F949AB183E7216E588F61
                                                                                                                                                                                                                                                                                              Function 00217387 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00217411
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0021749B
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: Crash Reports$OPERA_CRASH_LOG_DIR
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-687564514
                                                                                                                                                                                                                                                                                              • Opcode ID: 4b923df0d92e3667bf2927c7a6461618e156d998e01ed67c38ab4ac5c1ab3a5a
                                                                                                                                                                                                                                                                                              • Instruction ID: e33d59dcb96f68ac939ab91f1346f889411f3a4f1fea3bf2268b088ea5c6cf2f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4b923df0d92e3667bf2927c7a6461618e156d998e01ed67c38ab4ac5c1ab3a5a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F5314CB0A142155BCB12BF64EC82AFF77F8DFD2310F04447AFC059B282DA3199659A61
                                                                                                                                                                                                                                                                                              Function 002B5307 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateDirectoryW.KERNELBASE(?,00000000), ref: 002B532C
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002B533C
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc, xrefs: 002B5389
                                                                                                                                                                                                                                                                                              • CreateDirectory , xrefs: 002B539B
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc$CreateDirectory
                                                                                                                                                                                                                                                                                              • API String ID: 1375471231-4140125794
                                                                                                                                                                                                                                                                                              • Opcode ID: 6b69d35ad5fd336837aa11427ef32cfdee57e14bbe8faff4453c770b836efd8a
                                                                                                                                                                                                                                                                                              • Instruction ID: a0653cb55fb5ec7702a4834d10687a6dd6676f5aa627fd6b6cc8033b1e6a82dd
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6b69d35ad5fd336837aa11427ef32cfdee57e14bbe8faff4453c770b836efd8a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9212D71A102389BEB10BB54DC46FFAB3B89F54344F0440A9F949EB282D7625E588B61
                                                                                                                                                                                                                                                                                              Function 001F5A70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 001F5AB8
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 001F5B10
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: /:$ /:
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-2360831600
                                                                                                                                                                                                                                                                                              • Opcode ID: a6e667810d611c55f0b5564fbf4184dd2e85a5975978ef57d75ec49daa1707f1
                                                                                                                                                                                                                                                                                              • Instruction ID: 45187f09faec4f82e79156199356810cc73d0ce31d5093cfe4e5128a779abbb4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a6e667810d611c55f0b5564fbf4184dd2e85a5975978ef57d75ec49daa1707f1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8C01DB75E005189BC702EB68E852BAD7766DF47310F014176EE075F382E731AA118B92
                                                                                                                                                                                                                                                                                              Function 0021724C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0021727D
                                                                                                                                                                                                                                                                                                • Part of subcall function 002524E0: GetFileAttributesW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00252551
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AttributesFile_strlen
                                                                                                                                                                                                                                                                                              • String ID: Crash Reports$OPERA_CRASH_LOG_DIR
                                                                                                                                                                                                                                                                                              • API String ID: 2348415028-687564514
                                                                                                                                                                                                                                                                                              • Opcode ID: ed4761367ff85c34e1be0e8e80f355e6c70338bec4e1169564e3be7d09b20119
                                                                                                                                                                                                                                                                                              • Instruction ID: ccca8272f96e601a64dcb3254ac47359a218aeba7aad8be95ae86f1e4b5adf85
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ed4761367ff85c34e1be0e8e80f355e6c70338bec4e1169564e3be7d09b20119
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 383115F0B142095BDF05EF65A8416FFB7F59FE5310F044029EC19A7342EB31A96A8BA1
                                                                                                                                                                                                                                                                                              Function 00253180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_util_win.cc$OpenFile
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-4080947147
                                                                                                                                                                                                                                                                                              • Opcode ID: 401395874b072c6fcda0e495e1fb718d6e931a22d442b9dac44753b3cea5d261
                                                                                                                                                                                                                                                                                              • Instruction ID: 2ca87d0de3fa5a34d4fd0fd2a5c15f65ce18b0e0dab6cc34c136e9444ff8d71e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 401395874b072c6fcda0e495e1fb718d6e931a22d442b9dac44753b3cea5d261
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 583128716247906BE221AF248C02B6EBBA4AFC6B70F10471DFDF4971C1D770AA598786
                                                                                                                                                                                                                                                                                              Function 002EAA84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetFilePointerEx.KERNELBASE ref: 002EAAF5
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 002EAB32
                                                                                                                                                                                                                                                                                              • SetFilePointerEx, xrefs: 002EAB42
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FilePointer
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$SetFilePointerEx
                                                                                                                                                                                                                                                                                              • API String ID: 973152223-2639227240
                                                                                                                                                                                                                                                                                              • Opcode ID: 1be737ec66cff8337aae85e611f949bc5e4d61df6580964bbafb42f768ccd4f3
                                                                                                                                                                                                                                                                                              • Instruction ID: 8421f29b9cf888874914c7e44008c2521e321fca2ff84a29c313f1ff05ce2387
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1be737ec66cff8337aae85e611f949bc5e4d61df6580964bbafb42f768ccd4f3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7721CB72A143549BC720EF25980279FB7EAAFD4710F01851EE94967381D770A915CB93
                                                                                                                                                                                                                                                                                              Function 002EAB75 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 002EAA84: SetFilePointerEx.KERNELBASE ref: 002EAAF5
                                                                                                                                                                                                                                                                                              • SetEndOfFile.KERNELBASE(002B87EB), ref: 002EABA0
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • SetEndOfFile, xrefs: 002EABE1
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 002EABCF
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: File$Pointer
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$SetEndOfFile
                                                                                                                                                                                                                                                                                              • API String ID: 1339342385-591553600
                                                                                                                                                                                                                                                                                              • Opcode ID: 5f317331bb30b740ddba9aa272edaf9da0a58dacb88d6ecfc1918f97b852ed10
                                                                                                                                                                                                                                                                                              • Instruction ID: ea6c6e0f8993ffe4e003a0a525fc403f1f8a6bd87c4696fae3c9c7cf552edcdf
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5f317331bb30b740ddba9aa272edaf9da0a58dacb88d6ecfc1918f97b852ed10
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8701D8A1F903186BE720BAA55C43FBF731D8B14758F444064FE0867282DA656D144AA3
                                                                                                                                                                                                                                                                                              Function 002524E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00252551
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • DirectoryExists, xrefs: 0025252C
                                                                                                                                                                                                                                                                                              • ../../base/files/file_util_win.cc, xrefs: 00252527
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AttributesFile
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_util_win.cc$DirectoryExists
                                                                                                                                                                                                                                                                                              • API String ID: 3188754299-2653227169
                                                                                                                                                                                                                                                                                              • Opcode ID: b88130c74cb1d299f84fb41b42931a9aa136a0b1b17b108f57310d8c7a0078de
                                                                                                                                                                                                                                                                                              • Instruction ID: 186df8b3cc2fa144d940f0c291174205c3c392ca335a2813df5bb7e42a360d25
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b88130c74cb1d299f84fb41b42931a9aa136a0b1b17b108f57310d8c7a0078de
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 99012F72B107815BE3109F288C8666EB768EFCA770F100B1DF5F4972C1EBB0955586C2
                                                                                                                                                                                                                                                                                              Function 00252320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNELBASE(FFFFFFFF,?,00000000), ref: 00252391
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AttributesFile
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_util_win.cc$PathExists
                                                                                                                                                                                                                                                                                              • API String ID: 3188754299-1196770437
                                                                                                                                                                                                                                                                                              • Opcode ID: 34599791f88a8028675fbfb372ba089184c6c3af262b40f086435b0ea68bb1d3
                                                                                                                                                                                                                                                                                              • Instruction ID: 9a2f2dcb8d3ef482bd87045b2ad7ef04f6a347f33bea5badd3e70f78cda4fe2f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 34599791f88a8028675fbfb372ba089184c6c3af262b40f086435b0ea68bb1d3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B01F971A103816BD3119F288C4666EB768EFCA770F100B1EF9E5972C1EB71A55586C2
                                                                                                                                                                                                                                                                                              Function 0025A1D0 Relevance: 4.6, APIs: 3, Instructions: 71timeCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001F10CE,00000001,?,00000000), ref: 0025A239
                                                                                                                                                                                                                                                                                              • SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,001F10CE,00000001,?), ref: 0025A24B
                                                                                                                                                                                                                                                                                              • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,001F10CE,00000001,?,00000000), ref: 0025A282
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Time$System$File$LocalSpecific
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 979780441-0
                                                                                                                                                                                                                                                                                              • Opcode ID: b782ab139c9170f2b3d99336e936dc17f1a9ccdec83d4f9fe766a7484e5bdd39
                                                                                                                                                                                                                                                                                              • Instruction ID: 7269d7d8634af7306b522c5b3889277fa3a52de9617c600b3201db7392aad6c9
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b782ab139c9170f2b3d99336e936dc17f1a9ccdec83d4f9fe766a7484e5bdd39
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C621BF72E207868BD710CF34C842A66B7A8FFDA354F104B1EF8C496241EB71D688C782
                                                                                                                                                                                                                                                                                              Function 002EA51E Relevance: 4.6, APIs: 3, Instructions: 68fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ReadFile.KERNELBASE(00000000,00000000,7FFFFFFF,?,00000000,00000000,00000000), ref: 002EA553
                                                                                                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,?,7FFFFFFF,FFFFFFFF,00000000), ref: 002EA58A
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002EA596
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileRead$ErrorLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1577890643-0
                                                                                                                                                                                                                                                                                              • Opcode ID: c39ba36e87f16e7e241e39bac6c5f8c1f550ebc24635685d523664aa13cc3c6f
                                                                                                                                                                                                                                                                                              • Instruction ID: 7eefa7ba876e369242ebadd6a171a4de78cd6e1e7d3ecf9f72f9e0f540c1ccbd
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c39ba36e87f16e7e241e39bac6c5f8c1f550ebc24635685d523664aa13cc3c6f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DD11E931B5021A5FCB11CF65CC84AAE77ACEF49330F900625E926DB2C0DA31ED1487A2
                                                                                                                                                                                                                                                                                              Function 00258690 Relevance: 4.6, APIs: 3, Instructions: 56COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00258709
                                                                                                                                                                                                                                                                                              • GetNativeSystemInfo.KERNELBASE ref: 00258731
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0025875C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: InfoInit_thread_footerInit_thread_headerNativeSystem
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 420575652-0
                                                                                                                                                                                                                                                                                              • Opcode ID: d0b16e7d75d1e6743a6bbf0eb12e01373854de419602a09655d5e0ad0d1b6b10
                                                                                                                                                                                                                                                                                              • Instruction ID: a3b0ac66eebe3ab56df0830f4660ae82d91cbfe365baf2adf99556328027fbf6
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d0b16e7d75d1e6743a6bbf0eb12e01373854de419602a09655d5e0ad0d1b6b10
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C210A71D24280EBD302DF2CE9127A5B3A8FF8A321F100325FD8957251EFB199A58786
                                                                                                                                                                                                                                                                                              Function 002EAC0E Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNELBASE(002ACAFE), ref: 002EAC29
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • CloseHandle, xrefs: 002EAC6A
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 002EAC58
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseHandle
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$CloseHandle
                                                                                                                                                                                                                                                                                              • API String ID: 2962429428-1576210609
                                                                                                                                                                                                                                                                                              • Opcode ID: 414f8bc16fd1524adefa1ee5d5d02b18300a561421be9dddb32b29535bc089ce
                                                                                                                                                                                                                                                                                              • Instruction ID: 12f045a67f6e4f7c7e68d8ae423ac4780402f6bd9a72858005ce9cd42efc5b86
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 414f8bc16fd1524adefa1ee5d5d02b18300a561421be9dddb32b29535bc089ce
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8001A271A903196BEA21BA649C57FBF725E9F84710F410026FE096B2C2EB616D1486E2
                                                                                                                                                                                                                                                                                              Function 00241B70 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __aullrem.LIBCMT ref: 00241BAF
                                                                                                                                                                                                                                                                                                • Part of subcall function 00259A00: SystemFunction036.ADVAPI32(FFFFFFFF,FFFFFFFF,?,00241BE8,?,00000008,000000FF), ref: 00259A0E
                                                                                                                                                                                                                                                                                              • __aullrem.LIBCMT ref: 00241C04
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __aullrem$Function036System
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3297659922-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 91c38a388e12858b212670e45c05bb4b858f9c37bd6eea27800db80e954931fa
                                                                                                                                                                                                                                                                                              • Instruction ID: ffe52a5501aa0859823da1c6e2c775e4f0875aa21e439f72f1b51a504742d53e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 91c38a388e12858b212670e45c05bb4b858f9c37bd6eea27800db80e954931fa
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C711D332A042106BC7049F28CC05A4A7BAAEBC9370F15872DF8B95B2D1DB30A9448781
                                                                                                                                                                                                                                                                                              Function 0026CE6A Relevance: 1.6, APIs: 1, Instructions: 122COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileType.KERNELBASE(?,?,?,?,?,0026BA0A,00000008,?,?,?,?,?,00000000,003A4F64,00000000), ref: 0026CE88
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileType
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3081899298-0
                                                                                                                                                                                                                                                                                              • Opcode ID: fe5a797fe1aded8e30957e9194f9d3135a5a69b5b40fa549a3d6484a55c34cf3
                                                                                                                                                                                                                                                                                              • Instruction ID: 151c1c57d048e0d162bee7525472290dd8f8a542b47bbbb8892cc64306a7631c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe5a797fe1aded8e30957e9194f9d3135a5a69b5b40fa549a3d6484a55c34cf3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5B31E5B1A106068BDF24EF6DD8C167EB3BAAF45310F34493AE556C7650E632DC90CAA1
                                                                                                                                                                                                                                                                                              Function 0034F5C7 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __wsopen_s
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3347428461-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 4d18a59fdbb8025277a9831b273890a73660f305af12969f593679659bc37cf6
                                                                                                                                                                                                                                                                                              • Instruction ID: a89913e483ffed89407d2ca6261be5c7a55dd0b9f2768e44cd5a29922fe3fa5a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4d18a59fdbb8025277a9831b273890a73660f305af12969f593679659bc37cf6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CB116671A0420AAFCF06DF58E94199B7BF8EF49304F0540A9F809AB311D630ED21CBA4
                                                                                                                                                                                                                                                                                              Function 00233F70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCommandLineW.KERNEL32(?,00000000), ref: 00233FE7
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CommandLine
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3253501508-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 117394bcffe347462e240cc920e07b3d754e0e468a3f5fd5cc51be6520c784d7
                                                                                                                                                                                                                                                                                              • Instruction ID: 3c9ba4e8ce764cdfc82e1c9b7c1d15e66cc8b2cc75cc3315a94ad1073e872cb2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 117394bcffe347462e240cc920e07b3d754e0e468a3f5fd5cc51be6520c784d7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 18119EB15007018FE729EF10D818B13BBF5EF40718F05C19DD50A4B2A1EBB6A548CBE0
                                                                                                                                                                                                                                                                                              Function 002581C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CoInitializeEx.COMBASE(00000000,00000006,?,-00000001,?,001F107F,00000000), ref: 00258219
                                                                                                                                                                                                                                                                                                • Part of subcall function 0028E940: CoRegisterInitializeSpy.OLE32(00000000), ref: 0028E99E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Initialize$Register
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2642324518-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 73d2ea0dc2d77ee5f433c5ae103fd190247a9457cca7f6945c37dd3cfcc967c2
                                                                                                                                                                                                                                                                                              • Instruction ID: 3d9150aea650cdce0db2742cd2fe09c5728c76e1ae158074b5771f015ccb139d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 73d2ea0dc2d77ee5f433c5ae103fd190247a9457cca7f6945c37dd3cfcc967c2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7CF0C2716147009BD7109F69C805B277BE8AB85751F14806EED0ADB380DFF2D816C7A1
                                                                                                                                                                                                                                                                                              Function 002EA5C9 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE(?,76233390,00000003,00000000,00000000,00000080,00000000,7FFFFFFF), ref: 002EA5F4
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 323e25634b087a69ec328d698e3aa4c608bdcdc1209b9dff437b501e2b048d8c
                                                                                                                                                                                                                                                                                              • Instruction ID: 9d3155f977bbc2fb72d85e97b3decb9b4e55c6f64e855d879f5912005eb3ce05
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 323e25634b087a69ec328d698e3aa4c608bdcdc1209b9dff437b501e2b048d8c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E0E086715501747BE6315B25DC49FA7FF5CEB0A7A0F858141F44C9B041D270BC4087D1
                                                                                                                                                                                                                                                                                              Function 0033C9B7 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNELBASE(00000000,00000000,?,0033C675,?,?,00000000,?,0033C675,00000000,0000000C), ref: 0033C9D4
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 45f404b10063ed5671a66d391a17e3aab5c9a1be17fe9dac44f619d7153a6dd8
                                                                                                                                                                                                                                                                                              • Instruction ID: 90efd0e6d5b16274cf628833a0e2a737b7bfa36d5785cb747052d43536faba3c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 45f404b10063ed5671a66d391a17e3aab5c9a1be17fe9dac44f619d7153a6dd8
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBD06C3200014DBFDF028F84DC06EDA3BAAFB48714F018100BA1856060C732E821AB91
                                                                                                                                                                                                                                                                                              Function 00258370 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetHandleVerifier.ASSISTANT_INSTALLER(?,?,0025631A,?,00000000,?,003A4CF8,?,?,?,?,0025648D,00000000), ref: 00258377
                                                                                                                                                                                                                                                                                                • Part of subcall function 0028EB90: GetModuleHandleW.KERNEL32(00000000), ref: 0028EB9E
                                                                                                                                                                                                                                                                                                • Part of subcall function 0028EB90: GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 0028EBAA
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Handle$AddressModuleProcVerifier
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3286154149-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1cc07427af520186a7326f8132783c901fbcac9168e32443b6a52e1578090511
                                                                                                                                                                                                                                                                                              • Instruction ID: cbbe0e5ce29fede924ebf22ecd95f2183e1fcbd81b0d8f73379034835eea2907
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1cc07427af520186a7326f8132783c901fbcac9168e32443b6a52e1578090511
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92C02B31301128AF8F007F54D8008EF7B9CEF4B26130000A1F90A8B310DB307C014BE0
                                                                                                                                                                                                                                                                                              Function 0023AA30 Relevance: 1.3, APIs: 1, Instructions: 93COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,00216046,?,?,00000000), ref: 0023AAD9
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1452528299-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 3c091e4b7c821c47f8d307203815dc20611af4d976b962fdb9163712da8a8af2
                                                                                                                                                                                                                                                                                              • Instruction ID: 7c56c7cdb02403816c6bdc729206b03d0237bb7832b6a38ec0ecf0529dbef8eb
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3c091e4b7c821c47f8d307203815dc20611af4d976b962fdb9163712da8a8af2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1E3116B12143419FDB01DF10D88066BBBE6EF85358F048A2EF88557291DB30E625CB43
                                                                                                                                                                                                                                                                                              Function 002582A0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CoUninitialize.COMBASE ref: 002582D2
                                                                                                                                                                                                                                                                                                • Part of subcall function 0028E9E0: CoRevokeInitializeSpy.OLE32 ref: 0028EA13
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: InitializeRevokeUninitialize
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3049223277-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 9f7b4bac4c19006216e2b52bc61b56470f579269b2a516fd0cb19a1e560f96e6
                                                                                                                                                                                                                                                                                              • Instruction ID: 32e56c2b1f42d5d7c5efeff1fec187fdce8c29d96d575f05976500cbaee23d81
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9f7b4bac4c19006216e2b52bc61b56470f579269b2a516fd0cb19a1e560f96e6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E7F082302117068BD7149F95C498B577FE8EF01346F08845DE84ADB660CFB2E856CB94

                                                                                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                                                                                              Function 0025A6D0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 128threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentThread.KERNEL32 ref: 0025A709
                                                                                                                                                                                                                                                                                              • GetThreadPriority.KERNEL32(00000000), ref: 0025A70C
                                                                                                                                                                                                                                                                                              • GetCurrentThread.KERNEL32 ref: 0025A716
                                                                                                                                                                                                                                                                                              • SetThreadPriority.KERNEL32(00000000,00000002), ref: 0025A71B
                                                                                                                                                                                                                                                                                              • QueryPerformanceCounter.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0025A782
                                                                                                                                                                                                                                                                                              • GetCurrentThread.KERNEL32 ref: 0025A790
                                                                                                                                                                                                                                                                                              • SetThreadPriority.KERNEL32(00000000,?), ref: 0025A79B
                                                                                                                                                                                                                                                                                              • QueryPerformanceFrequency.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0025A7B2
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0025A87E
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0025A8A5
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0025A8B7
                                                                                                                                                                                                                                                                                              • QueryPerformanceCounter.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0025A8E1
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0025A8FF
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Thread$CurrentPerformancePriorityQuery$CounterInit_thread_footerInit_thread_header$Frequency
                                                                                                                                                                                                                                                                                              • String ID: 0&
                                                                                                                                                                                                                                                                                              • API String ID: 521408450-3638886966
                                                                                                                                                                                                                                                                                              • Opcode ID: c05bcb33663979e3a0221307210dbe2f99c469462a18d847ea7a2aaeceeb12d4
                                                                                                                                                                                                                                                                                              • Instruction ID: f62023d3a868bdd220f18d6405a6a15d2f5b719c539ab1dc19c3dc45d1b281c1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c05bcb33663979e3a0221307210dbe2f99c469462a18d847ea7a2aaeceeb12d4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8851F8718057409FC303DF38E85960AB7E8FFCA3A5F11871AF84963261DB719546CB42
                                                                                                                                                                                                                                                                                              Function 00210746 Relevance: 24.4, APIs: 16, Instructions: 391COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetUserNameW.ADVAPI32(?,?), ref: 002108BB
                                                                                                                                                                                                                                                                                              • GetNamedSecurityInfoW.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000,?,?,?,00000000), ref: 00210905
                                                                                                                                                                                                                                                                                              • GetNamedSecurityInfoW.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000,?), ref: 0021093C
                                                                                                                                                                                                                                                                                              • GetExplicitEntriesFromAclW.ADVAPI32(?,?,?,?,?,00000000), ref: 00210958
                                                                                                                                                                                                                                                                                              • CheckTokenMembership.ADVAPI32(00000000,?,FFFFFFFF), ref: 0021099C
                                                                                                                                                                                                                                                                                              • BuildExplicitAccessWithNameW.ADVAPI32(?,?,?,00000001,00000003,?,?,00000000), ref: 002109D3
                                                                                                                                                                                                                                                                                              • SetEntriesInAclW.ADVAPI32(00000001,?,00000000,?,?,?,00000000), ref: 002109E9
                                                                                                                                                                                                                                                                                              • SetEntriesInAclW.ADVAPI32(?,?,?,?,?,?,00000000), ref: 00210A0A
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,00000000), ref: 00210A1B
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,00000000), ref: 00210A2A
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,00000000), ref: 00210A3B
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,00000000), ref: 00210A4A
                                                                                                                                                                                                                                                                                              • SetNamedSecurityInfoW.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000), ref: 00210A86
                                                                                                                                                                                                                                                                                              • SetNamedSecurityInfoW.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000), ref: 00210ADA
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?), ref: 00210B00
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?), ref: 00210B0F
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FreeLocal$InfoNamedSecurity$Entries$ExplicitName$AccessBuildCheckFromMembershipTokenUserWith
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4240689945-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 98cc27ac0dd380519a9b48ee1852847d95772c30eb0dd4a756b33f77e24bdb64
                                                                                                                                                                                                                                                                                              • Instruction ID: ed9efd9500c2bc75f53f4affbab759e7c81a9c2b300b983eb6337210235ba7a2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 98cc27ac0dd380519a9b48ee1852847d95772c30eb0dd4a756b33f77e24bdb64
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D8D1CE71614302AFDB10CF64C884AABBBE9FF99350F00452DF945CB241EBB1E995CBA1
                                                                                                                                                                                                                                                                                              Function 00254EE0 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 406processsynchronizationCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(00211A0E,00000001,00000001,?,003A4C28), ref: 00254FB6
                                                                                                                                                                                                                                                                                              • CreateEnvironmentBlock.USERENV(00000000,?,00000000,?), ref: 0025517C
                                                                                                                                                                                                                                                                                              • CreateProcessAsUserW.ADVAPI32(?,00000000,FFFFFFFF,00000000,00000000,?,00000000,00000000,00000000,?,?,00000000,?,00000000,?), ref: 002551BD
                                                                                                                                                                                                                                                                                              • DestroyEnvironmentBlock.USERENV(00000000), ref: 002551C9
                                                                                                                                                                                                                                                                                              • GetEnvironmentStringsW.KERNEL32(?), ref: 0025524D
                                                                                                                                                                                                                                                                                              • FreeEnvironmentStringsW.KERNEL32(?), ref: 00255330
                                                                                                                                                                                                                                                                                              • CreateProcessW.KERNEL32(00000000,FFFFFFFF,00000000,00000000,?,00000000,00000000,00000000,?,?,?), ref: 00255376
                                                                                                                                                                                                                                                                                              • AssignProcessToJobObject.KERNEL32(?,00000000), ref: 002553BE
                                                                                                                                                                                                                                                                                              • AllowSetForegroundWindow.USER32(00000000), ref: 002553DB
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF,?), ref: 002553EC
                                                                                                                                                                                                                                                                                                • Part of subcall function 00256240: GetLastError.KERNEL32(?,003A4CF8,?,?,0025648D,00000000,?,?,?,0025B3EC), ref: 00256255
                                                                                                                                                                                                                                                                                                • Part of subcall function 00256240: SetLastError.KERNEL32(00000000,?,?,0025648D,00000000,?,?,?,0025B3EC), ref: 0025628C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00256240: GetCurrentProcess.KERNEL32(?,003A4CF8,?,?,0025648D,00000000,?,?,?,0025B3EC), ref: 00256296
                                                                                                                                                                                                                                                                                                • Part of subcall function 002565B0: GetCurrentProcess.KERNEL32(5D5B5F5E,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002565CE
                                                                                                                                                                                                                                                                                                • Part of subcall function 002565B0: TerminateProcess.KERNEL32(C569482A,^_[],5D5B5F5E,?), ref: 002565DA
                                                                                                                                                                                                                                                                                                • Part of subcall function 002565B0: GetCurrentProcess.KERNEL32 ref: 002565F0
                                                                                                                                                                                                                                                                                                • Part of subcall function 002565B0: WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 00256642
                                                                                                                                                                                                                                                                                                • Part of subcall function 002565B0: GetCurrentProcess.KERNEL32 ref: 0025664E
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Process$CurrentEnvironment$CreateObject$BlockErrorLastSingleStringsWait$AllowAssignDestroyForegroundFreeHandleInformationTerminateUserWindow
                                                                                                                                                                                                                                                                                              • String ID: ../../base/process/launch_win.cc$LaunchProcess
                                                                                                                                                                                                                                                                                              • API String ID: 4109405000-1974568409
                                                                                                                                                                                                                                                                                              • Opcode ID: 127d18bbf1700e80bc369a48ba6cb59bd220a344cbf4843da7a3b470cf580404
                                                                                                                                                                                                                                                                                              • Instruction ID: 3cf433552018f029bbf097ad6304154162ca55e81d4e9c5f5b9e3f9a2607b68f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 127d18bbf1700e80bc369a48ba6cb59bd220a344cbf4843da7a3b470cf580404
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 08F1E170528781ABE721DF24C854B6BBBE1BF84315F044A1CF899872D1DBB0E95CCB96
                                                                                                                                                                                                                                                                                              Function 002E6D0E Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 284synchronizationthreadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,002E70A0,00000000,00000000,00000000), ref: 002E6E01
                                                                                                                                                                                                                                                                                              • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 002E6ECE
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32 ref: 002E6EE3
                                                                                                                                                                                                                                                                                                • Part of subcall function 002ACB18: GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 002ACB49
                                                                                                                                                                                                                                                                                                • Part of subcall function 002ACB18: CreateNamedPipeW.KERNELBASE ref: 002ACBA4
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 002E6F30
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?), ref: 002E6FC6
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 002E6FD3
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 002E7051
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc, xrefs: 002E6E38, 002E6E6B
                                                                                                                                                                                                                                                                                              • CreateThread, xrefs: 002E6E4F
                                                                                                                                                                                                                                                                                              • CreateNamedPipe, xrefs: 002E6E86
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireCreateRelease$CompletionNamedObjectPipeQueuedSingleStatusThreadVersionWait
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc$CreateNamedPipe$CreateThread
                                                                                                                                                                                                                                                                                              • API String ID: 995286921-1199881885
                                                                                                                                                                                                                                                                                              • Opcode ID: 6de18881cf220558b8ab8b1ef5e3fdac03a7836473b79f20f02fa753c27d1ce7
                                                                                                                                                                                                                                                                                              • Instruction ID: b4fd15907fb9d985f4a0634017fd13d016d938874f848485e2dbca35af53cea8
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6de18881cf220558b8ab8b1ef5e3fdac03a7836473b79f20f02fa753c27d1ce7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17B1E0B19183419FC710EF25D884A6ABBE4FF94350F444A2EF89A8B391D731DD58CB92
                                                                                                                                                                                                                                                                                              Function 00212770 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00212814
                                                                                                                                                                                                                                                                                              • DeviceIoControl.KERNEL32 ref: 0021285D
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00212869
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • IsValid, xrefs: 002127D3
                                                                                                                                                                                                                                                                                              • \\.\%lc:, xrefs: 0021279B
                                                                                                                                                                                                                                                                                              • ../../opera/desktop/windows/os_operations/os_operations_impl.cc, xrefs: 002127CE
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ControlCreateDeviceErrorFileLast
                                                                                                                                                                                                                                                                                              • String ID: ../../opera/desktop/windows/os_operations/os_operations_impl.cc$IsValid$\\.\%lc:
                                                                                                                                                                                                                                                                                              • API String ID: 1247001307-2475376787
                                                                                                                                                                                                                                                                                              • Opcode ID: 4927c2f369ea9140baf8470e7293941b95f7b799e044a1260e48711d4e422907
                                                                                                                                                                                                                                                                                              • Instruction ID: b2926f70d945edad04fe4e1e1e048e0e6e1a89cfb50ea9df480f458fb9b7526b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4927c2f369ea9140baf8470e7293941b95f7b799e044a1260e48711d4e422907
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4431E4B19147419FD701EF69C98556BFBE4FF98300F008A2EF8D593251EB70A698CB92
                                                                                                                                                                                                                                                                                              Function 0026C3B6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(0026FE4E,?,?,?,?,?,?,?,?,00000000,?,?,?,0026FE4E,?), ref: 0026C3EA
                                                                                                                                                                                                                                                                                                • Part of subcall function 002AC8A4: CreateFileW.KERNELBASE ref: 002AC8EF
                                                                                                                                                                                                                                                                                                • Part of subcall function 002AC8A4: GetLastError.KERNEL32 ref: 002AC8F6
                                                                                                                                                                                                                                                                                                • Part of subcall function 002AC8A4: WaitNamedPipeW.KERNEL32(?,000000FF), ref: 002AC914
                                                                                                                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32(0026C770,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0026C440
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateCurrentErrorExceptionFileFilterLastNamedPipeProcessUnhandledWait
                                                                                                                                                                                                                                                                                              • String ID: HO:$XO:$dO:
                                                                                                                                                                                                                                                                                              • API String ID: 4079065440-2052611368
                                                                                                                                                                                                                                                                                              • Opcode ID: 43ddb614032d45225212dc876e6e766e64383170b9e7127cce9dc2861203b28c
                                                                                                                                                                                                                                                                                              • Instruction ID: e4f5748f92991062d6aba27b486a19f4260cd501f79c5995224c69dc30eeef0e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 43ddb614032d45225212dc876e6e766e64383170b9e7127cce9dc2861203b28c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F521C8F19102009FCB01EF19EC4695ABBE8FF95314F01816BFC458B252DBB18924CF92
                                                                                                                                                                                                                                                                                              Function 0021051B Relevance: 7.6, APIs: 5, Instructions: 74COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,0021043C,SeTakeOwnershipPrivilege), ref: 0021053C
                                                                                                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,00000020,?,?,?,?,?,?,?,?,?,0021043C,SeTakeOwnershipPrivilege), ref: 00210546
                                                                                                                                                                                                                                                                                                • Part of subcall function 00201B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,002012C9,00000000), ref: 00201BAB
                                                                                                                                                                                                                                                                                                • Part of subcall function 00201B9C: SetLastError.KERNEL32(00000000,?,002012C9,00000000), ref: 00201BCA
                                                                                                                                                                                                                                                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00210577
                                                                                                                                                                                                                                                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0021043C,SeTakeOwnershipPrivilege), ref: 002105A9
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0021043C,SeTakeOwnershipPrivilege), ref: 002105B3
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2332101959-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 01f38d7440814e13ee9003f93c50d69e98235c41da13f72f619a000816f35f85
                                                                                                                                                                                                                                                                                              • Instruction ID: 2168e8bfa72881e47a2a52beeb5ccac2e173b4c83a9e35a288656a2e6e100e18
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 01f38d7440814e13ee9003f93c50d69e98235c41da13f72f619a000816f35f85
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47217A70A10209AFDB049FA9DC88AAEBBFCFF08314F44452AE805A7251D7719D50CF60
                                                                                                                                                                                                                                                                                              Function 001F4C11 Relevance: 35.5, APIs: 1, Strings: 19, Instructions: 480COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 001F4CC2
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CurrentProcess
                                                                                                                                                                                                                                                                                              • String ID: " | FIND /c /i ".exe"$88:$88:$88:$88:$88:$88:$88:$:again$IF %PID_RUNNING%==TRUE ($IF %PID_RUNNING%==TRUE GOTO :again$IF ERRORLEVEL 1 SET PID_RUNNING=FALSE$SET PID_RUNNING=TRUE$TASKLIST /FI "PID eq $del "$del %0 & rmdir "$k.bat$ping -n 2 127.0.0.1$z5
                                                                                                                                                                                                                                                                                              • API String ID: 2050909247-3896600840
                                                                                                                                                                                                                                                                                              • Opcode ID: 3709cafcab10860ac2d9343d9907059557f20f5c71588cf93b348d745fea33c9
                                                                                                                                                                                                                                                                                              • Instruction ID: e9b1920f60ef11d244fff087f65e5ebc077ee80c5c57ba37410420fcf698108d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3709cafcab10860ac2d9343d9907059557f20f5c71588cf93b348d745fea33c9
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D7F1F2707043406FCB15FB24C895ABEBBE9AFD9710F04442CF94A8B392DB3499958B92
                                                                                                                                                                                                                                                                                              Function 002041C0 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 284COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID: HKCU$Registry value is not a dictionary$clean$data$name$path$type$values$wow6432
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-3483028338
                                                                                                                                                                                                                                                                                              • Opcode ID: 6bf293f3b3ee85d1a70be2b1ae22c7ebfc65d84727451f657bde5da69455fc30
                                                                                                                                                                                                                                                                                              • Instruction ID: 4fc8c15ab1fa694f1146217b269f476efabd88c4d880c1fa8ce124ec3a0cbba4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6bf293f3b3ee85d1a70be2b1ae22c7ebfc65d84727451f657bde5da69455fc30
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A2A1ACB16143419BCB14EF24D88096FF7E9AFC5304F00892EFA855B292DB70ED19CB92
                                                                                                                                                                                                                                                                                              Function 0020ADD0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 215COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0020AC60: InitializeCriticalSectionEx.KERNEL32(-0000000C,00000000,00000000,00000000,?,0020A9BB,?,0020A76B,?), ref: 0020AC69
                                                                                                                                                                                                                                                                                                • Part of subcall function 0020AC60: GetLastError.KERNEL32(?,0020A9BB,?,0020A76B,?), ref: 0020AC73
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0020AEBE
                                                                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?,?,?), ref: 0020AED4
                                                                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(001F0000,?,00000104), ref: 0020AF1E
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0020AFAB
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0020AFBA
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0020B05B
                                                                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?,Module,?), ref: 0020B073
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0020B081
                                                                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?,Module_Raw,?), ref: 0020B0A0
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CriticalSection$Enter$Leave$Module$ErrorFileHandleInitializeLastName
                                                                                                                                                                                                                                                                                              • String ID: "$MZx$Module$Module_Raw$REGISTRY
                                                                                                                                                                                                                                                                                              • API String ID: 2998937331-1297953865
                                                                                                                                                                                                                                                                                              • Opcode ID: 7f5ead2ae36129400a5293762c6f750e4065b3eb480a8419c9f1877a1c4fe3ee
                                                                                                                                                                                                                                                                                              • Instruction ID: f3eac5581ccbcb582a8f5509deb8374b3debc8fd117604227171ba413278d414
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7f5ead2ae36129400a5293762c6f750e4065b3eb480a8419c9f1877a1c4fe3ee
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 23713BB2A14702ABD322DF20CC45BBFB3A9AF85304F14452DF9459B283EB76D9158793
                                                                                                                                                                                                                                                                                              Function 0020ADE0 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 221COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0020AC60: InitializeCriticalSectionEx.KERNEL32(-0000000C,00000000,00000000,00000000,?,0020A9BB,?,0020A76B,?), ref: 0020AC69
                                                                                                                                                                                                                                                                                                • Part of subcall function 0020AC60: GetLastError.KERNEL32(?,0020A9BB,?,0020A76B,?), ref: 0020AC73
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0020D12C
                                                                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?,?,?), ref: 0020D142
                                                                                                                                                                                                                                                                                              • GetModuleFileNameW.KERNEL32(001F0000,?,00000104), ref: 0020D188
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0020D230
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0020D23F
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0020D2E0
                                                                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?,Module,?), ref: 0020D2F8
                                                                                                                                                                                                                                                                                              • EnterCriticalSection.KERNEL32(?), ref: 0020D306
                                                                                                                                                                                                                                                                                              • LeaveCriticalSection.KERNEL32(?,Module_Raw,?), ref: 0020D325
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CriticalSection$Enter$Leave$Module$ErrorFileHandleInitializeLastName
                                                                                                                                                                                                                                                                                              • String ID: "$Module$Module_Raw$REGISTRY
                                                                                                                                                                                                                                                                                              • API String ID: 2998937331-3881418485
                                                                                                                                                                                                                                                                                              • Opcode ID: 2777171c9323282a3197d0074fc2f5128e2ff8275ea2814094dd94d8e306fc11
                                                                                                                                                                                                                                                                                              • Instruction ID: 6ac951c7e4e491378dc4ca5c805ec11b98d33485818abf2b9397cde7472732f1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2777171c9323282a3197d0074fc2f5128e2ff8275ea2814094dd94d8e306fc11
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 55715C71A25702ABD321DFA0DC45BAFB3A8AF85300F14452CFD099B283EB75D915CB92
                                                                                                                                                                                                                                                                                              Function 002923A0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 99COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0029249D
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 002924C6
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 002924D8
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: EnterCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 003294F2
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: LeaveCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 0032952F
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00292501
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00292513
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0029253C
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header$CriticalSection$EnterLeave
                                                                                                                                                                                                                                                                                              • String ID: dQ:$dQ:$dQ:$dQ:$dQ:$dQ:
                                                                                                                                                                                                                                                                                              • API String ID: 1029325649-188147023
                                                                                                                                                                                                                                                                                              • Opcode ID: 835eab0dcf004f8ae65e552f41ac06f511c1d2c60acf21766b0f7ed975eea14f
                                                                                                                                                                                                                                                                                              • Instruction ID: bccc483bfc3283e3cbd7793862ed388074f08cbd33244d7b265d6ffd8c0b070a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 835eab0dcf004f8ae65e552f41ac06f511c1d2c60acf21766b0f7ed975eea14f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A9312CB4A21710DBDB16EF24E842B3A7390EB43714F18423AD5165B7C2E7B4B815CF92
                                                                                                                                                                                                                                                                                              Function 002565B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 98synchronizationCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(5D5B5F5E,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002565CE
                                                                                                                                                                                                                                                                                              • TerminateProcess.KERNEL32(C569482A,^_[],5D5B5F5E,?), ref: 002565DA
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 002565F0
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200FA3,00000000), ref: 002565F8
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00200FA3,00000000), ref: 00256604
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00256614
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 00256632
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 00256642
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 0025664E
                                                                                                                                                                                                                                                                                              • GetExitCodeProcess.KERNEL32(00000000,FFFFFFFF), ref: 0025667D
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 00256690
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Process$Current$ObjectSingleWait$CodeErrorExitLastTerminate
                                                                                                                                                                                                                                                                                              • String ID: ^_[]
                                                                                                                                                                                                                                                                                              • API String ID: 2432511979-568551382
                                                                                                                                                                                                                                                                                              • Opcode ID: 5a334640d13d2cb0fdf2e34d0e14837a59df1e1f583b7f0ac816f817de098231
                                                                                                                                                                                                                                                                                              • Instruction ID: 23e1479eadd738f80ce08079ac2ca33d05ccd870582abe9f8db70bd032c21824
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a334640d13d2cb0fdf2e34d0e14837a59df1e1f583b7f0ac816f817de098231
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E631C7B06242419BD7259F78D80C76A7BBCAF41307F944519EC82D7190CB79A898CF56
                                                                                                                                                                                                                                                                                              Function 00214EA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 130comCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CoCreateInstance.OLE32(003661B4,00000000,00000017,0035D4A8,-00000020), ref: 00214EC8
                                                                                                                                                                                                                                                                                              • CoAllowSetForegroundWindow.OLE32(?,00000000), ref: 00214EDF
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel, xrefs: 00214EF1, 00214FAF
                                                                                                                                                                                                                                                                                              • Email, xrefs: 00214F5E
                                                                                                                                                                                                                                                                                              • page=SettingsPageAppsDefaults, xrefs: 00214EEC
                                                                                                                                                                                                                                                                                              • page=SettingsPageAppsDefaults&target=%ls, xrefs: 00214F92
                                                                                                                                                                                                                                                                                              • SystemSettings_DefaultApps_%ls, xrefs: 00214F63
                                                                                                                                                                                                                                                                                              • Browser, xrefs: 00214F2B
                                                                                                                                                                                                                                                                                              • mailto, xrefs: 00214F48
                                                                                                                                                                                                                                                                                              • http, xrefs: 00214F15
                                                                                                                                                                                                                                                                                              • SettingsPageAppsDefaultsProtocolView, xrefs: 00214F76
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AllowCreateForegroundInstanceWindow
                                                                                                                                                                                                                                                                                              • String ID: Browser$Email$SettingsPageAppsDefaultsProtocolView$SystemSettings_DefaultApps_%ls$http$mailto$page=SettingsPageAppsDefaults$page=SettingsPageAppsDefaults&target=%ls$windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel
                                                                                                                                                                                                                                                                                              • API String ID: 14021637-918448973
                                                                                                                                                                                                                                                                                              • Opcode ID: 76f12f7960c5df28e85996a00a0b77c6b1fa88e99556104ecb7dabd17c222a0f
                                                                                                                                                                                                                                                                                              • Instruction ID: 390f1a9d0c4ff4d800347161629cc8696312a655ce184c78576321f521280d0f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 76f12f7960c5df28e85996a00a0b77c6b1fa88e99556104ecb7dabd17c222a0f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5E41E2B0A10218AFEB11EFA0CC86FEAB7B8EF15705F040065FC09AB242D771AD55CB61
                                                                                                                                                                                                                                                                                              Function 002105DD Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 112memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 002105FE
                                                                                                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,0000000A,?), ref: 00210608
                                                                                                                                                                                                                                                                                                • Part of subcall function 00201B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,002012C9,00000000), ref: 00201BAB
                                                                                                                                                                                                                                                                                                • Part of subcall function 00201B9C: SetLastError.KERNEL32(00000000,?,002012C9,00000000), ref: 00201BCA
                                                                                                                                                                                                                                                                                              • GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,?), ref: 0021063A
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00210644
                                                                                                                                                                                                                                                                                              • LocalAlloc.KERNEL32(00000040,?), ref: 00210654
                                                                                                                                                                                                                                                                                              • GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 00210670
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0021068C
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002106D9
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(00000000), ref: 00210721
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../opera/desktop/windows/common/access_control/access_control_utils_impl.cc, xrefs: 002106B4, 002106F9
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$Token$InformationLocalProcess$AllocCurrentFreeOpen
                                                                                                                                                                                                                                                                                              • String ID: ../../opera/desktop/windows/common/access_control/access_control_utils_impl.cc
                                                                                                                                                                                                                                                                                              • API String ID: 2525985394-4103139186
                                                                                                                                                                                                                                                                                              • Opcode ID: f601a27e2a24df11d828e682ccf452bbf7a37461d96340050f3dbbe537915405
                                                                                                                                                                                                                                                                                              • Instruction ID: 10270e2f8cbed5e2df1ac5a1faaf7cd44bba2df3f93cbcf81079ee39576f243a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f601a27e2a24df11d828e682ccf452bbf7a37461d96340050f3dbbe537915405
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5541D471A10209ABEB116F60DC86FEEB7B9AF54701F000159F505AB2C1DBB119A4CFA2
                                                                                                                                                                                                                                                                                              Function 002ACDD8 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 83COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetVersion.KERNEL32 ref: 002ACDF1
                                                                                                                                                                                                                                                                                              • InitializeCriticalSectionEx.KERNEL32(?,00000000,10000000), ref: 002ACE3F
                                                                                                                                                                                                                                                                                              • InitializeCriticalSection.KERNEL32(?), ref: 002ACE9A
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 002ACEBE
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 002ACEF1
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • kernel32.dll, xrefs: 002ACEDA
                                                                                                                                                                                                                                                                                              • dO:, xrefs: 002ACEA2
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/win/critical_section_with_debug_info.cc, xrefs: 002ACE6B
                                                                                                                                                                                                                                                                                              • InitializeCriticalSectionEx, xrefs: 002ACE7D
                                                                                                                                                                                                                                                                                              • ::InitializeCriticalSectionEx, xrefs: 002ACED5
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CriticalInitializeSection$Init_thread_footerInit_thread_headerVersion
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/win/critical_section_with_debug_info.cc$::InitializeCriticalSectionEx$InitializeCriticalSectionEx$dO:$kernel32.dll
                                                                                                                                                                                                                                                                                              • API String ID: 668362183-3574978869
                                                                                                                                                                                                                                                                                              • Opcode ID: 9ab097e985e11378b1a78c3dee0a3719a054152e07314fe8ae4ebad5e5c2f6b5
                                                                                                                                                                                                                                                                                              • Instruction ID: 330051696a84a1226df95b52ea5112d0568edd97fd0ce51734b310e80bee0a35
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9ab097e985e11378b1a78c3dee0a3719a054152e07314fe8ae4ebad5e5c2f6b5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 72214870B602009BDA21AB64AD07FBE7369DB87300F104436FE056B2C1DB716C108A92
                                                                                                                                                                                                                                                                                              Function 00256AE0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82threadlibraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0028E230: TryAcquireSRWLockExclusive.KERNEL32(00000000,'&,?,?,?,00256B03,'&,?,?,0026E527,?), ref: 0028E251
                                                                                                                                                                                                                                                                                              • GetCurrentThread.KERNEL32 ref: 00256B50
                                                                                                                                                                                                                                                                                              • IsDebuggerPresent.KERNEL32('&,?,?,0026E527,?), ref: 00256B6B
                                                                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 00256B7D
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00256BA4
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(Kernel32.dll,'&,?,?,0026E527,?), ref: 00256BBE
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 00256BCA
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00256BDA
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CurrentThread$AcquireAddressDebuggerExclusiveHandleInit_thread_footerInit_thread_headerLockModulePresentProc
                                                                                                                                                                                                                                                                                              • String ID: '&$Kernel32.dll$SetThreadDescription
                                                                                                                                                                                                                                                                                              • API String ID: 4238099923-4013201203
                                                                                                                                                                                                                                                                                              • Opcode ID: e8217e0de4cbbffa96a0f267a4beb85cc2ae663c4bd13d2cec61e271c6c40042
                                                                                                                                                                                                                                                                                              • Instruction ID: d90420ef16f7f97ef5f62b670eb790463433ced2cdd36b40bd7fb3ffdaac7cab
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e8217e0de4cbbffa96a0f267a4beb85cc2ae663c4bd13d2cec61e271c6c40042
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 66218A71A10204AFDB02AF64EC99A7E776CEF41325F54002AFC06E7281EB317C158B95
                                                                                                                                                                                                                                                                                              Function 0020CBA0 Relevance: 16.8, APIs: 11, Instructions: 295stringregistryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0020BADE: CharNextW.USER32(?,00000000,7693A7D0,?,00000000,?,80004005), ref: 0020BB07
                                                                                                                                                                                                                                                                                                • Part of subcall function 0020BADE: CharNextW.USER32(?,00000000,7693A7D0,?,00000000,?,80004005), ref: 0020BB1D
                                                                                                                                                                                                                                                                                              • lstrcmpiW.KERNEL32(?,00358380,?,?,?,?), ref: 0020CBF1
                                                                                                                                                                                                                                                                                              • lstrcmpiW.KERNEL32(?,00358384), ref: 0020CC01
                                                                                                                                                                                                                                                                                              • lstrcmpiW.KERNEL32(?,00358388), ref: 0020CC11
                                                                                                                                                                                                                                                                                              • lstrcmpiW.KERNEL32(?,0035838C), ref: 0020CC21
                                                                                                                                                                                                                                                                                              • CharNextW.USER32(?), ref: 0020CC86
                                                                                                                                                                                                                                                                                              • CharNextW.USER32(?), ref: 0020CDC5
                                                                                                                                                                                                                                                                                              • CharNextW.USER32(00000000), ref: 0020CDDC
                                                                                                                                                                                                                                                                                              • RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,-00000002,-00000002), ref: 0020CE30
                                                                                                                                                                                                                                                                                              • VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 0020CE81
                                                                                                                                                                                                                                                                                              • RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 0020CEAF
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CharNext$lstrcmpi$Value$From
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2620931725-0
                                                                                                                                                                                                                                                                                              • Opcode ID: a6328131d7873f2f04d0108e3bd381739852675da61ffabf9553116cb535c9b7
                                                                                                                                                                                                                                                                                              • Instruction ID: e4337031d82b826268dacbbcbd533e66d6da075ba8f2c4cafffac513d5e53845
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a6328131d7873f2f04d0108e3bd381739852675da61ffabf9553116cb535c9b7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 56A149B19103169BDB319F10CC8ABF977B5EF54700F2002AAFA059B2D2D7745EA1DB92
                                                                                                                                                                                                                                                                                              Function 002E67CA Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 248COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileInformationByHandleEx.KERNEL32(?,00000002,00000000,00000210,?), ref: 002E6816
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(?), ref: 002E6986
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?), ref: 002E6A52
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(?,?,?), ref: 002E6A9C
                                                                                                                                                                                                                                                                                              • PostQueuedCompletionStatus.KERNEL32(00006461,00000000,?,00000000,?,?), ref: 002E6AAE
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(?,?,?), ref: 002E6AB5
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • GetFileInformationByHandleEx, xrefs: 002E684F
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc, xrefs: 002E6840
                                                                                                                                                                                                                                                                                              • \\.\pipe, xrefs: 002E68E3
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireRelease$CompletionFileHandleInformationPostQueuedStatus
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc$GetFileInformationByHandleEx$\\.\pipe
                                                                                                                                                                                                                                                                                              • API String ID: 3092314435-838569524
                                                                                                                                                                                                                                                                                              • Opcode ID: 061a2a70d4f54593c777ff6cd411f9f47e113f2a92a0e9c99ac00c40fc5d51f6
                                                                                                                                                                                                                                                                                              • Instruction ID: 367a3fbfbd558678c982e5c90d6edc99531e7c8328d88d910e532767429d401b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 061a2a70d4f54593c777ff6cd411f9f47e113f2a92a0e9c99ac00c40fc5d51f6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B1A1C1B05107409FD311DF39C884A56BBE4FF58304F108A2EE89A9B752E731F926CB91
                                                                                                                                                                                                                                                                                              Function 00210C20 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 179COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetNamedSecurityInfoW.ADVAPI32(?,?,?,?,?,?,?,?), ref: 00210C91
                                                                                                                                                                                                                                                                                              • GetExplicitEntriesFromAclW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 00210CC2
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00210CE2
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00210CF0
                                                                                                                                                                                                                                                                                              • EqualSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 00210DB3
                                                                                                                                                                                                                                                                                              • EqualSid.ADVAPI32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 00210DF0
                                                                                                                                                                                                                                                                                              • FreeSid.ADVAPI32(FFFFFFFF,?,?,?,?,?,?,?,?,?), ref: 00210E07
                                                                                                                                                                                                                                                                                              • FreeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?), ref: 00210E20
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../opera/desktop/windows/common/access_control/access_control_utils_impl.cc, xrefs: 00210D4C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Free$EqualLocal$EntriesExplicitFromInfoNamedSecurity
                                                                                                                                                                                                                                                                                              • String ID: ../../opera/desktop/windows/common/access_control/access_control_utils_impl.cc
                                                                                                                                                                                                                                                                                              • API String ID: 3814160775-4103139186
                                                                                                                                                                                                                                                                                              • Opcode ID: 278462a961c47e0caf390d28908aef2271925961c0e995e22714f9cb27e808dc
                                                                                                                                                                                                                                                                                              • Instruction ID: 724de8853c8d26bcd8f8bfea38af984687cd3235ee396e95e77d0ef044e0f7dc
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 278462a961c47e0caf390d28908aef2271925961c0e995e22714f9cb27e808dc
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A717D719102598FDB21DFA4C984BEEBBF8AF14300F04459AE909B7251D7B1AAD4CFA1
                                                                                                                                                                                                                                                                                              Function 002044A0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 175COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID: No name in a registry key value$No type information on a registry key value$Registry value is not a dictionary$data$name$type
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-1085468316
                                                                                                                                                                                                                                                                                              • Opcode ID: 1dfee4c3c950c07439b05eba9addef499b557ab2ec03c6aca1a70d7dbebb4ece
                                                                                                                                                                                                                                                                                              • Instruction ID: 2b0699713ae600cf29c703eedd81fe8cd45280f0ee268ade0d76f7dbe2e43f7c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1dfee4c3c950c07439b05eba9addef499b557ab2ec03c6aca1a70d7dbebb4ece
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8E51F2B1614340ABCB14EF14D88196FF7A9EFC5310F008D2EFA965B292DB71E915CB52
                                                                                                                                                                                                                                                                                              Function 00252DF0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 166COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00252E6C
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000050), ref: 00252E8D
                                                                                                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 00252F54
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00252F64
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00252FDC
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(?), ref: 0025300E
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$AttributesFile$CreateDirectory
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_util_win.cc$CreateDirectoryAndGetError$DirectoryExists
                                                                                                                                                                                                                                                                                              • API String ID: 3677629684-252988939
                                                                                                                                                                                                                                                                                              • Opcode ID: 5b29afa43cb5dfc874d78eb1b713c15617dab89e3034b8c1a0716cecb74cb4b5
                                                                                                                                                                                                                                                                                              • Instruction ID: d6dca86b89ccb68d768c68181a55f8fb59d0fbc5ab2604a74e6b2ab33746f4c4
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5b29afa43cb5dfc874d78eb1b713c15617dab89e3034b8c1a0716cecb74cb4b5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C75130719287829BD721DF24DC4176AB3A4BFD6321F104B1DF8E0972C1DB70A91D8B96
                                                                                                                                                                                                                                                                                              Function 002D4980 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 161libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 002D49A5
                                                                                                                                                                                                                                                                                              • EventRegister.ADVAPI32(?,002D4AA0,00000000,00000018,?,?,?,?,?,002D496A,Google.Chrome,00368194,00292FF0,00000000), ref: 002D4A0E
                                                                                                                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,api-ms-win-eventing-provider-l1-1-0.dll,FFFFFFFF), ref: 002D4A2C
                                                                                                                                                                                                                                                                                              • GetModuleHandleExW.KERNEL32(00000000,advapi32.dll,FFFFFFFF), ref: 002D4A3E
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(FFFFFFFF,EventSetInformation), ref: 002D4A50
                                                                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(FFFFFFFF), ref: 002D4A76
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • api-ms-win-eventing-provider-l1-1-0.dll, xrefs: 002D4A25
                                                                                                                                                                                                                                                                                              • EventSetInformation, xrefs: 002D4A48
                                                                                                                                                                                                                                                                                              • advapi32.dll, xrefs: 002D4A37
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: HandleModule$AddressEventFreeLibraryProcRegister_strlen
                                                                                                                                                                                                                                                                                              • String ID: EventSetInformation$advapi32.dll$api-ms-win-eventing-provider-l1-1-0.dll
                                                                                                                                                                                                                                                                                              • API String ID: 2182669159-147808218
                                                                                                                                                                                                                                                                                              • Opcode ID: f5cba03f3365ba904f905f8a191d8bf220d5bb28fbba241b4b881e1e27019b0e
                                                                                                                                                                                                                                                                                              • Instruction ID: 787349ad68c7c25c5635b49d50424a9125988271298dee2bd057097262f00b80
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f5cba03f3365ba904f905f8a191d8bf220d5bb28fbba241b4b881e1e27019b0e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 02511272A10215AFCB219F55DC54EAB7BE9FF88710F01412AF8499B360D771EC20CBA4
                                                                                                                                                                                                                                                                                              Function 0026E1C4 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 156libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 001F3696: _strlen.LIBCMT ref: 001F36AD
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0026E274
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 0026E345
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,SetUnhandledExceptionFilter), ref: 0026E355
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen$AddressHandleModuleProc
                                                                                                                                                                                                                                                                                              • String ID: /prefetch:7$SetUnhandledExceptionFilter$fallback-handler$kernel32.dll$test-child-process$type
                                                                                                                                                                                                                                                                                              • API String ID: 3627888737-2824896278
                                                                                                                                                                                                                                                                                              • Opcode ID: 0a5b0f4c53fb797302a0b4136a96e6c82bdcb91232bb63fe446917ea5710bf80
                                                                                                                                                                                                                                                                                              • Instruction ID: 5ec35a89a5f0368e3191a8ee7f80491e1d5a39ef6623944bf24748e48e990a64
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0a5b0f4c53fb797302a0b4136a96e6c82bdcb91232bb63fe446917ea5710bf80
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5A5127B06147516BDF02FF31DC82A7F7B99AF91750F00082DF48697281EF219A698B93
                                                                                                                                                                                                                                                                                              Function 00240100 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(003A3F44,?,?,0027DA32,?), ref: 0024015D
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(003A3F44,FFFFFFFF,0027DA32), ref: 002401EF
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0024021D
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00240255
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00240267
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: EnterCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 003294F2
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: LeaveCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 0032952F
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0024028B
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CriticalExclusiveInit_thread_footerInit_thread_headerLockSection$AcquireEnterLeaveRelease
                                                                                                                                                                                                                                                                                              • String ID: 4?:$D?:$D?:
                                                                                                                                                                                                                                                                                              • API String ID: 604925594-3288849641
                                                                                                                                                                                                                                                                                              • Opcode ID: 4d38d0e534e1ddef0552fb185fefba158f387cb6e06167ea5dc9ea697765fa0a
                                                                                                                                                                                                                                                                                              • Instruction ID: ff193734acc4d00527db348053a92ee98fa5b5e7309b2a976579327cbab2971e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4d38d0e534e1ddef0552fb185fefba158f387cb6e06167ea5dc9ea697765fa0a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A4124B0E202019FD712DF54EC96B6AB3B8FB56710F100169F91A5B380D771AE54CBA2
                                                                                                                                                                                                                                                                                              Function 0026C770 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 82sleepthreadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • Sleep.KERNEL32(00000001), ref: 0026C795
                                                                                                                                                                                                                                                                                              • SleepEx.KERNEL32(000000FF,00000000), ref: 0026C7F8
                                                                                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 0026C7FE
                                                                                                                                                                                                                                                                                              • SetEvent.KERNEL32 ref: 0026C81F
                                                                                                                                                                                                                                                                                              • Sleep.KERNEL32(0000EA60), ref: 0026C82A
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(../../third_party/crashpad/crashpad/client/crashpad_client_win.cc,000000AF,00000002), ref: 0026C874
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/client/crashpad_client_win.cc, xrefs: 0026C7C6, 0026C84D
                                                                                                                                                                                                                                                                                              • crash server failed to launch, self-terminating, xrefs: 0026C7D8
                                                                                                                                                                                                                                                                                              • crash server did not respond, self-terminating, xrefs: 0026C85F
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Sleep$Current$EventProcessThread
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$crash server did not respond, self-terminating$crash server failed to launch, self-terminating
                                                                                                                                                                                                                                                                                              • API String ID: 1277712822-2636089577
                                                                                                                                                                                                                                                                                              • Opcode ID: 4bf55d8c62bd9be5d79e0bf4a3b2ec3681020b72acf378704ee2ce6e864b3e06
                                                                                                                                                                                                                                                                                              • Instruction ID: 95f26b6b819d5dd1acb9e469128ed0b88489460d747e9922c25b8aaca3a5a00d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4bf55d8c62bd9be5d79e0bf4a3b2ec3681020b72acf378704ee2ce6e864b3e06
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 83213771B60314AFEB22BF64AC06BAD376DAB45710F500021F644EB1D2DBB299908F82
                                                                                                                                                                                                                                                                                              Function 00254730 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 174fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(FFFFFFFF,FFFFFFFF,FFFFFFFF,00000000,00000000,FFFFFFFF,00000000,?,00000000), ref: 00254893
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002548A1
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 002548D8
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 002548E8
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000057,?,00000000), ref: 002548FE
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0025492F
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$CreateFile
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_win.cc$DoInitialize
                                                                                                                                                                                                                                                                                              • API String ID: 1722934493-2688016777
                                                                                                                                                                                                                                                                                              • Opcode ID: ada122475a66c566ea2c34fc6d6ad54f9268ab7d33444f015800dce4aba1c3a0
                                                                                                                                                                                                                                                                                              • Instruction ID: cde533e3b5f2f247cadd9e138e7ba41e0808d140cc11ed1f5e6b042e2ee0d9a7
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ada122475a66c566ea2c34fc6d6ad54f9268ab7d33444f015800dce4aba1c3a0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F515372E207505BEB008F18CC8675AB7D5ABC9324F0A462DFD89972C1CBB4DD548BD2
                                                                                                                                                                                                                                                                                              Function 002B0B4C Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 165COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 002B0B68
                                                                                                                                                                                                                                                                                              • OpenProcess.KERNEL32(00000451,00000001,00000000), ref: 002B0B76
                                                                                                                                                                                                                                                                                                • Part of subcall function 00201B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,002012C9,00000000), ref: 00201BAB
                                                                                                                                                                                                                                                                                                • Part of subcall function 00201B9C: SetLastError.KERNEL32(00000000,?,002012C9,00000000), ref: 00201BCA
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLastProcess$CurrentOpen
                                                                                                                                                                                                                                                                                              • String ID: --thread=$<&$<&$database$exception-pointers$process
                                                                                                                                                                                                                                                                                              • API String ID: 4145867261-3603526766
                                                                                                                                                                                                                                                                                              • Opcode ID: f68a329a019f91e7d1e49f3fe5bf86c5fc9e497868d4e3bf155df33960f7c785
                                                                                                                                                                                                                                                                                              • Instruction ID: d1dfde062086be71f04d7bfcb64ccf957c47d52b0d86579de6053b95b88fa4cf
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f68a329a019f91e7d1e49f3fe5bf86c5fc9e497868d4e3bf155df33960f7c785
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 635117B1518301AFD701EF60D882AAFBBE5AFD4314F00492DF1C596191EB71E659CB53
                                                                                                                                                                                                                                                                                              Function 00258510 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0025856A
                                                                                                                                                                                                                                                                                              • GetVersionExW.KERNEL32(0000011C), ref: 0025859C
                                                                                                                                                                                                                                                                                              • GetProductInfo.KERNEL32(?,?,00000000,00000000,00000000), ref: 002585BB
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00258607
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00258619
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: EnterCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 003294F2
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: LeaveCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 0032952F
                                                                                                                                                                                                                                                                                              • GetNativeSystemInfo.KERNEL32(?), ref: 00258644
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00258670
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CriticalInfoInit_thread_footerInit_thread_headerSection$EnterLeaveNativeProductSystemVersion
                                                                                                                                                                                                                                                                                              • String ID: HL:
                                                                                                                                                                                                                                                                                              • API String ID: 2982442099-453565649
                                                                                                                                                                                                                                                                                              • Opcode ID: c05693a27cc39cccb7d2bc2312825e8d5f04c2d8db7f0ff20baa1de3b7c1f10c
                                                                                                                                                                                                                                                                                              • Instruction ID: 136a353e495ae2c991e6179eff5b52f72bc0739bf47dedbca5b92d0b86e14919
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c05693a27cc39cccb7d2bc2312825e8d5f04c2d8db7f0ff20baa1de3b7c1f10c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 35311571904340EFD312DF24ED46BAAB3A8FFC6321F10462AF94957291EBB16504CB92
                                                                                                                                                                                                                                                                                              Function 001FE648 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _strncpy.LIBCMT ref: 001FE6F1
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 001FE738
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001FE7B7
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_strlen_strncpy
                                                                                                                                                                                                                                                                                              • String ID: %s%s %s$%s:%s$[%03u.%03u] $[printf format error]
                                                                                                                                                                                                                                                                                              • API String ID: 3471477319-1858063255
                                                                                                                                                                                                                                                                                              • Opcode ID: 5446e0e668ee42ecc409895734134213421fc82e2d571ce239407e253a353859
                                                                                                                                                                                                                                                                                              • Instruction ID: 5f8f50ef363b1e80b2b0b8f941eaf13717ec94dd7f7700965577c1847b082554
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5446e0e668ee42ecc409895734134213421fc82e2d571ce239407e253a353859
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3F5107B2A003446BE711EF24DC42F7BB7ADDFD5310F040529F945DB2A2EB70D51486A2
                                                                                                                                                                                                                                                                                              Function 00256E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 84synchronizationthreadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetThreadId.KERNEL32(?), ref: 00256E4A
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00256E60
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00256F00
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00256F0D
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?), ref: 00256F46
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • Join, xrefs: 00256EE1
                                                                                                                                                                                                                                                                                              • ../../base/threading/platform_thread_win.cc, xrefs: 00256EDC
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseHandle$ErrorLastObjectSingleThreadWait
                                                                                                                                                                                                                                                                                              • String ID: ../../base/threading/platform_thread_win.cc$Join
                                                                                                                                                                                                                                                                                              • API String ID: 2286813250-821740204
                                                                                                                                                                                                                                                                                              • Opcode ID: 614b0a886ff65015c864013b9b5772b214c6a66381be3091567307ceb57ce74a
                                                                                                                                                                                                                                                                                              • Instruction ID: 0e249600101ade565d977e492cc745e28fe891db37268e2195a2132f3027311b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 614b0a886ff65015c864013b9b5772b214c6a66381be3091567307ceb57ce74a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A021D2718143899BC700EF64DC069AEBBA8BFD5360F104B1DF9A5862E1EB719614CB83
                                                                                                                                                                                                                                                                                              Function 002523C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileAttributesW.KERNEL32(001F3FCC,?,00000000), ref: 00252430
                                                                                                                                                                                                                                                                                              • CreateFileW.KERNEL32(001F3FCC,001F3FCC,00000007,00000000,00000003,02000000,00000000), ref: 00252459
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-7FFFFFFF), ref: 00252465
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 00252478
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 00252491
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../base/files/file_util_win.cc, xrefs: 00252408
                                                                                                                                                                                                                                                                                              • PathHasAccess, xrefs: 0025240D
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorLast$File$AttributesCreate
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_util_win.cc$PathHasAccess
                                                                                                                                                                                                                                                                                              • API String ID: 3969751566-2396493888
                                                                                                                                                                                                                                                                                              • Opcode ID: 30b824c63189445ddca2714844252ec7cc1a496b41307645161d08eda03ff75e
                                                                                                                                                                                                                                                                                              • Instruction ID: a5a0c398e534dc6934b1110237554a17f459eaa420c5ed1dc24c1b33347a8733
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 30b824c63189445ddca2714844252ec7cc1a496b41307645161d08eda03ff75e
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E214B715103406BE311AF38DC86B6E7768AFC6731F100B19F9A5A61C1EFB099198AC6
                                                                                                                                                                                                                                                                                              Function 00258440 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0025848D
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,0023A24E,00000004,?), ref: 002584AF
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 002584BB
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 002584CE
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 002584F9
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressCurrentHandleInit_thread_footerInit_thread_headerModuleProcProcess
                                                                                                                                                                                                                                                                                              • String ID: GetProcessMitigationPolicy$kernel32.dll
                                                                                                                                                                                                                                                                                              • API String ID: 3099737979-1680159014
                                                                                                                                                                                                                                                                                              • Opcode ID: c851883099477a11354d94b72b7ead76bcb03c4fede178f7d823c12420e38b82
                                                                                                                                                                                                                                                                                              • Instruction ID: 4f8c5683d8ce06b4ea20bbb33c160af818f420e7bf70b08f0e6f463fb82f0dc3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c851883099477a11354d94b72b7ead76bcb03c4fede178f7d823c12420e38b82
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 77117D31A811056FC7119B74FD1ABAA376CFB52322F140125ED06D7280CFB15804CB96
                                                                                                                                                                                                                                                                                              Function 00210EA0 Relevance: 12.3, APIs: 8, Instructions: 288memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FreeSid.ADVAPI32(00000000), ref: 002110A2
                                                                                                                                                                                                                                                                                              • SetEntriesInAclW.ADVAPI32(00000001,?,?,00000000), ref: 002110BD
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?), ref: 002110D1
                                                                                                                                                                                                                                                                                              • SetNamedSecurityInfoW.ADVAPI32 ref: 00211133
                                                                                                                                                                                                                                                                                              • FreeSid.ADVAPI32(?), ref: 00211189
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?), ref: 002111B1
                                                                                                                                                                                                                                                                                              • AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000004,?,?,00210DE5), ref: 0021122C
                                                                                                                                                                                                                                                                                                • Part of subcall function 00211273: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000004,?,?,00210DA3), ref: 002112C3
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Free$AllocateInitializeLocal$EntriesInfoNamedSecurity
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1499235685-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 3fe3e2a0d9736a124a02752b7e47f2110c13bc19e68fe9dbcc1a7026a89ee7fa
                                                                                                                                                                                                                                                                                              • Instruction ID: 35cf307ebb423a7df69cc559a06540fc84abc76930f4abee437343d6a9cb881e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3fe3e2a0d9736a124a02752b7e47f2110c13bc19e68fe9dbcc1a7026a89ee7fa
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63B1AE71A183429FC710DF68D48166FFBF5AF98710F004A2EFA8597250E771E9A4CB82
                                                                                                                                                                                                                                                                                              Function 002100E0 Relevance: 12.1, APIs: 8, Instructions: 119memoryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 002100FC
                                                                                                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,0000000A,?), ref: 00210106
                                                                                                                                                                                                                                                                                                • Part of subcall function 00201B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,002012C9,00000000), ref: 00201BAB
                                                                                                                                                                                                                                                                                                • Part of subcall function 00201B9C: SetLastError.KERNEL32(00000000,?,002012C9,00000000), ref: 00201BCA
                                                                                                                                                                                                                                                                                              • GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,?,?), ref: 0021014E
                                                                                                                                                                                                                                                                                              • GetTokenInformation.ADVAPI32(?,00000013(TokenIntegrityLevel),?,00000004,?), ref: 00210174
                                                                                                                                                                                                                                                                                              • DuplicateToken.ADVAPI32(?,00000001,?,?), ref: 00210193
                                                                                                                                                                                                                                                                                              • AllocateAndInitializeSid.ADVAPI32 ref: 002101F1
                                                                                                                                                                                                                                                                                              • CheckTokenMembership.ADVAPI32(?,?,?), ref: 00210208
                                                                                                                                                                                                                                                                                              • FreeSid.ADVAPI32(?), ref: 0021021C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Token$ErrorInformationLastProcess$AllocateCheckCurrentDuplicateFreeInitializeMembershipOpen
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 3176607045-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 27b7d8bcef2442809f6a7f7ee080598fcc7bade149cd7d7890504ebc51f10bf3
                                                                                                                                                                                                                                                                                              • Instruction ID: 1252347df288efabfeff127065f2c585ad92065465ce0c16a3509679b6e12b95
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 27b7d8bcef2442809f6a7f7ee080598fcc7bade149cd7d7890504ebc51f10bf3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E41B57191030A9FDF119FA0CC88AEEBBF8FF18314F104229E901B61A0EB759995CF60
                                                                                                                                                                                                                                                                                              Function 00258770 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 267COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000011C,?,?,002585FC,0000011C,003A4C50,?), ref: 002587A7
                                                                                                                                                                                                                                                                                              • IsWow64Process.KERNEL32(00000000,00000000), ref: 002587BB
                                                                                                                                                                                                                                                                                                • Part of subcall function 00257730: RegOpenKeyExW.ADVAPI32(?,?,00000000,?,00000000), ref: 0025775F
                                                                                                                                                                                                                                                                                                • Part of subcall function 00257730: RegCloseKey.ADVAPI32(00000000), ref: 00257772
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Process$CloseCurrentOpenWow64
                                                                                                                                                                                                                                                                                              • String ID: PL:$ReleaseId$SOFTWARE\Microsoft\Windows NT\CurrentVersion$UBR
                                                                                                                                                                                                                                                                                              • API String ID: 108380400-1881083454
                                                                                                                                                                                                                                                                                              • Opcode ID: 15a797f3ac8a901355571b826cc8f54e4771efd27d245e54e47cef154645461c
                                                                                                                                                                                                                                                                                              • Instruction ID: 47731832be8c7262bcae0ee49d4c5163ff7c90b677a0bae3b6a635f7fb00d245
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 15a797f3ac8a901355571b826cc8f54e4771efd27d245e54e47cef154645461c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64B1C7B0118741CFE724CF24C494767BBE1FF88309F044A1EE88A9B681DBB4E958CB56
                                                                                                                                                                                                                                                                                              Function 00214A40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 244COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetDesktopWindow.USER32 ref: 00214AE8
                                                                                                                                                                                                                                                                                              • FindWindowExW.USER32(00000000,00000000,ApplicationFrameWindow,00000000), ref: 00214AF6
                                                                                                                                                                                                                                                                                              • GetDesktopWindow.USER32 ref: 00214BB5
                                                                                                                                                                                                                                                                                              • FindWindowExW.USER32(00000000,?,ApplicationFrameWindow,00000000), ref: 00214BC4
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Window$DesktopFind
                                                                                                                                                                                                                                                                                              • String ID: ApplicationFrameWindow$http
                                                                                                                                                                                                                                                                                              • API String ID: 2454690640-1697478608
                                                                                                                                                                                                                                                                                              • Opcode ID: c88ceab868b9f0471b4ab7e58ba2ad610a9e634b0671c671afe29c3f580ccb26
                                                                                                                                                                                                                                                                                              • Instruction ID: 1d00fb16151479af5713c70f20d54d2ca74e9c9a391b9965285dc72356c24a33
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c88ceab868b9f0471b4ab7e58ba2ad610a9e634b0671c671afe29c3f580ccb26
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 508108B1E113159FCB11EFA8D881AEEBBF5EF54310F10052AE815AB341DB70AA65CBD1
                                                                                                                                                                                                                                                                                              Function 0028E230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,'&,?,?,?,00256B03,'&,?,?,0026E527,?), ref: 0028E251
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AcquireExclusiveLock
                                                                                                                                                                                                                                                                                              • String ID: '&
                                                                                                                                                                                                                                                                                              • API String ID: 4021432409-1992014146
                                                                                                                                                                                                                                                                                              • Opcode ID: db54428c456a4df0812fd206ea1d6211a746fbe6b0a55722d834546bf4bc00e0
                                                                                                                                                                                                                                                                                              • Instruction ID: 8b8fe8397f48fd32dfa7b0aefdbe9f98968ce15d8448b9c38236efa4cb8d86d9
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: db54428c456a4df0812fd206ea1d6211a746fbe6b0a55722d834546bf4bc00e0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F071BDB8B112058FDF14EF64D491A7ABBF5BF59300F1641A9E80A9B392D770EC10CB91
                                                                                                                                                                                                                                                                                              Function 00254C10 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 161fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateFileMappingW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00254CCF
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00254CE2
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 00254D1D
                                                                                                                                                                                                                                                                                              • MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 00254DF9
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • MapFileRegionToMemory, xrefs: 00254C5A
                                                                                                                                                                                                                                                                                              • ../../base/files/memory_mapped_file_win.cc, xrefs: 00254C55
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFileLast$CreateMappingView
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/memory_mapped_file_win.cc$MapFileRegionToMemory
                                                                                                                                                                                                                                                                                              • API String ID: 2231327692-1672964651
                                                                                                                                                                                                                                                                                              • Opcode ID: 1c6d78bdc1de9c295c7bf8e033114045a9eb2ba911435f40cb5841ae3419397d
                                                                                                                                                                                                                                                                                              • Instruction ID: 28a3e5a00df401e7a2e3a0c72bc0c6548879c11aa60145f44d46ba29a8c903de
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c6d78bdc1de9c295c7bf8e033114045a9eb2ba911435f40cb5841ae3419397d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A551D1716243009BD710EF14C881B2BF7FAEBC4719F148A2DF98587281D7B4E959CB5A
                                                                                                                                                                                                                                                                                              Function 00256CC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00100000,00257020,00000000,00010000,00000000), ref: 00256D0B
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?), ref: 00256D22
                                                                                                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?), ref: 00256D4E
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00256DD2
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00256DFC
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • create_thread_last_error, xrefs: 00256DE5
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseCreateErrorHandleInit_thread_footerInit_thread_headerLastThread
                                                                                                                                                                                                                                                                                              • String ID: create_thread_last_error
                                                                                                                                                                                                                                                                                              • API String ID: 1016829980-3219933969
                                                                                                                                                                                                                                                                                              • Opcode ID: e7f6905e7de34fa0396f0b6940c84dc998b649ec25f44a773f099fab7bf22a8a
                                                                                                                                                                                                                                                                                              • Instruction ID: b608e8e05a48b1cb3e6aee5ac65f53457a248f6e10b5e03bcb108461905c4f26
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e7f6905e7de34fa0396f0b6940c84dc998b649ec25f44a773f099fab7bf22a8a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0318DB1B112159FEB12DF54EC8AF7E77B4EB46311F440425FC099B241E671AC18CB66
                                                                                                                                                                                                                                                                                              Function 00254AC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateFileMappingW.KERNEL32 ref: 00254B50
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00254B5D
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000), ref: 00254B9A
                                                                                                                                                                                                                                                                                                • Part of subcall function 00258370: GetHandleVerifier.ASSISTANT_INSTALLER(?,?,0025631A,?,00000000,?,003A4CF8,?,?,?,?,0025648D,00000000), ref: 00258377
                                                                                                                                                                                                                                                                                              • MapViewOfFile.KERNEL32 ref: 00254BE1
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • MapImageToMemory, xrefs: 00254B08
                                                                                                                                                                                                                                                                                              • ../../base/files/memory_mapped_file_win.cc, xrefs: 00254B03
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFileLast$CreateHandleMappingVerifierView
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/memory_mapped_file_win.cc$MapImageToMemory
                                                                                                                                                                                                                                                                                              • API String ID: 1014098455-1841746395
                                                                                                                                                                                                                                                                                              • Opcode ID: 40532c60c7c4aed121e89dc99f9c9704511cc048148861bf393ee1b3a396a0fd
                                                                                                                                                                                                                                                                                              • Instruction ID: 071fe385388f955178306c4dffaaea3489fdda155ab183b2da2dfd3ac0f953d1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 40532c60c7c4aed121e89dc99f9c9704511cc048148861bf393ee1b3a396a0fd
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E831C3729247418BC311EF28888662EB7F5AFC9725F000B1EF9C693281EB71D558CB86
                                                                                                                                                                                                                                                                                              Function 002AA2C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • RaiseException.KERNEL32(E0000008,00000001,00000001,00100000,00000000,?,00279CD9,?m%,?,00256D3F,00100000,?,?,?), ref: 002AA2D7
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00100000,?,E0000008,?,00279CD9,?m%,?,00256D3F,00100000,?,?,?), ref: 002BA063
                                                                                                                                                                                                                                                                                              • VirtualFree.KERNEL32(00000000,00000000,00008000,?,E0000008,?,00279CD9,?m%,?,00256D3F,00100000,?,?,?), ref: 002BA085
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(00000000,?,E0000008,?,00279CD9,?m%,?,00256D3F,00100000,?,?,?), ref: 002BA0B0
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireExceptionFreeRaiseReleaseVirtual
                                                                                                                                                                                                                                                                                              • String ID: V:$ V:
                                                                                                                                                                                                                                                                                              • API String ID: 329190654-1583870150
                                                                                                                                                                                                                                                                                              • Opcode ID: 5c5c852d8710acf46a5bf8e0f2a21564a5e61bb17bc6140f25d386d735327aa2
                                                                                                                                                                                                                                                                                              • Instruction ID: 3961f8e79f0a9b6b4c0d518912176b6af8e46ba2bf7b0a3d15fdf5b1e7defb1b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5c5c852d8710acf46a5bf8e0f2a21564a5e61bb17bc6140f25d386d735327aa2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF117BB1A30A047BE7127F54AC45BEE732CF746750F840411F644572A2DBB25D104BEB
                                                                                                                                                                                                                                                                                              Function 003409A4 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 003409EC
                                                                                                                                                                                                                                                                                              • __fassign.LIBCMT ref: 00340BD1
                                                                                                                                                                                                                                                                                              • __fassign.LIBCMT ref: 00340BEE
                                                                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00340C36
                                                                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00340C76
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00340D1E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileWrite__fassign$ConsoleErrorLastOutput
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1735259414-0
                                                                                                                                                                                                                                                                                              • Opcode ID: ec39ba08c7c2cae286a9d14056c02151a2d2fe8f2bc28202413d59738e4c493b
                                                                                                                                                                                                                                                                                              • Instruction ID: ea0db76621bf1b20d400b9c14af29c88e02f11c02e2b785225c19cf30b66bce3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec39ba08c7c2cae286a9d14056c02151a2d2fe8f2bc28202413d59738e4c493b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5CC17175E002589FCB1ACFE8C8809EDBBF9EF49314F28415AE955BB241D631AD46CF50
                                                                                                                                                                                                                                                                                              Function 00210260 Relevance: 9.1, APIs: 6, Instructions: 125COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 00210305
                                                                                                                                                                                                                                                                                              • OpenProcessToken.ADVAPI32(00000000,0000000A,?), ref: 0021030F
                                                                                                                                                                                                                                                                                              • DuplicateToken.ADVAPI32(?,00000001,?,?), ref: 00210338
                                                                                                                                                                                                                                                                                              • GetNamedSecurityInfoW.ADVAPI32 ref: 00210387
                                                                                                                                                                                                                                                                                              • AccessCheck.ADVAPI32(?,?,?,?,?,?,?,?), ref: 002103B5
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(00000000), ref: 002103EC
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ProcessToken$AccessCheckCurrentDuplicateFreeInfoLocalNamedOpenSecurity
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 1559206406-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 67d295895e30dd6fb0d69abe5ad7e5463c979a36d6a9cc9ea21bb41db4eeba35
                                                                                                                                                                                                                                                                                              • Instruction ID: 054469cb448db6d9700327739aeb42f527aa9ba256ab2f1c0e36061042ad88ea
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 67d295895e30dd6fb0d69abe5ad7e5463c979a36d6a9cc9ea21bb41db4eeba35
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1541BF716183469FD701CF65C884A6FBBE8FF98354F008A2EF495A3250E7B1D995CB82
                                                                                                                                                                                                                                                                                              Function 00278290 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 208COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(000000D0), ref: 002782C6
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(?), ref: 002783F1
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                                                                                              • String ID: ../../base/debug/activity_tracker.cc$RecordProcessExit$^_[]
                                                                                                                                                                                                                                                                                              • API String ID: 17069307-2666811147
                                                                                                                                                                                                                                                                                              • Opcode ID: 706c8300b4bfa25d64f095aa710d21e6c63439568774d8707c9182affa05bd75
                                                                                                                                                                                                                                                                                              • Instruction ID: f1cb373a01b8063183560c2849e1fd6f8cb95356a2cd3e1223f2bac084b4dc74
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 706c8300b4bfa25d64f095aa710d21e6c63439568774d8707c9182affa05bd75
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B2819EB06107018FDB20DF25C885B12BBE4BF19714F1486ADE88E8B652DB71F859CB91
                                                                                                                                                                                                                                                                                              Function 0023A330 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 177COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileInformationByHandle.KERNEL32(00000000,?,?,00000000), ref: 0023A40F
                                                                                                                                                                                                                                                                                              • __fread_nolock.LIBCMT ref: 0023A48E
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ReadStreamToStringWithMaxSize, xrefs: 0023A3C3
                                                                                                                                                                                                                                                                                              • ../../base/files/file_util.cc, xrefs: 0023A3BE
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileHandleInformation__fread_nolock
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_util.cc$ReadStreamToStringWithMaxSize
                                                                                                                                                                                                                                                                                              • API String ID: 860753551-4143436111
                                                                                                                                                                                                                                                                                              • Opcode ID: 66acc216a5beebcae9943f48380d105fd03be53e54028820ae873cfa2a80f372
                                                                                                                                                                                                                                                                                              • Instruction ID: de97f4fd21455620eba85a7125268c94aa68b9eb1b5b2b49aa93603627e87c55
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 66acc216a5beebcae9943f48380d105fd03be53e54028820ae873cfa2a80f372
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF6103B1A143819BE711DF24CC8172BB7E5AFC5310F144A2DF9C89B281E7B1DA558B83
                                                                                                                                                                                                                                                                                              Function 002D4E30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00989680,?,002A987A,?,?,00000028,?,?,?,?,00989680), ref: 002D4E4B
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(00000000,?,002A987A,?,?,00000028,?,?,?,?,00989680), ref: 002D4E69
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(00000000,?,002A987A,?,?,00000028,?,?,?,?,00989680), ref: 002D4EBB
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../base/files/important_file_writer_cleaner.cc, xrefs: 002D4F09
                                                                                                                                                                                                                                                                                              • AddDirectory, xrefs: 002D4F0E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$Release$Acquire
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/important_file_writer_cleaner.cc$AddDirectory
                                                                                                                                                                                                                                                                                              • API String ID: 1021914862-215382998
                                                                                                                                                                                                                                                                                              • Opcode ID: 09757b362e6ea31564c0fef098cffd3bcc21b993ba026e74b8baab696917e7e0
                                                                                                                                                                                                                                                                                              • Instruction ID: a268853908c1f3a07a1fa4088b886fab7cee2d2a0a20269fde31a81ea6833743
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 09757b362e6ea31564c0fef098cffd3bcc21b993ba026e74b8baab696917e7e0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E73124B0E10215AFDB05FF30D885AAEBBA5BF04305F04011AF8095B782D774AD348BD2
                                                                                                                                                                                                                                                                                              Function 0023C850 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104windowCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FormatMessageA.KERNEL32(00001200,00000000,0023CACF,00000000,?,00000100,00000000), ref: 0023C90B
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 0023C929
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 0023C991
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • Error (0x%lX) while retrieving error. (0x%lX), xrefs: 0023C999
                                                                                                                                                                                                                                                                                              • (0x%lX), xrefs: 0023C91A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFormatLastMessage_strlen
                                                                                                                                                                                                                                                                                              • String ID: (0x%lX)$Error (0x%lX) while retrieving error. (0x%lX)
                                                                                                                                                                                                                                                                                              • API String ID: 2706427827-3206765257
                                                                                                                                                                                                                                                                                              • Opcode ID: f84dc8afccd24702bf9d558ec82a0532be025bbc19835ceb921f3fb6f34d4ced
                                                                                                                                                                                                                                                                                              • Instruction ID: 4c99cfe4905eb523f6a53c350a460158e2d1664cb34919e6889f4f1bb8993f1e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f84dc8afccd24702bf9d558ec82a0532be025bbc19835ceb921f3fb6f34d4ced
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 604194B19187C19AE3219B14DC82BBBBBA4BFDE310F104B1DF9C496141EBB09554C793
                                                                                                                                                                                                                                                                                              Function 002EE690 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateWindowExW.USER32 ref: 002EE743
                                                                                                                                                                                                                                                                                                • Part of subcall function 002EE4D0: RegisterClassExW.USER32(00000030), ref: 002EE536
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ClassCreateRegisterWindow
                                                                                                                                                                                                                                                                                              • String ID: $[:$$[:$../../base/win/message_window.cc$Failed to create a message-only window
                                                                                                                                                                                                                                                                                              • API String ID: 3469048531-3483064902
                                                                                                                                                                                                                                                                                              • Opcode ID: feee60be47803f4931888c66c9be96274544d05a5df051b3e8c252845be028a6
                                                                                                                                                                                                                                                                                              • Instruction ID: 7a258bec34178155b9e8be63b4496296da72b2d3aaea4d2f0139e24ea48443d8
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: feee60be47803f4931888c66c9be96274544d05a5df051b3e8c252845be028a6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36314BB0A503045BD715EF25C842B6FB7E9EF89700F418529F9485B3C2EB7099148BB2
                                                                                                                                                                                                                                                                                              Function 0022E2C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E325
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E387
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E399
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: EnterCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 003294F2
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: LeaveCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 0032952F
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E3D2
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CriticalInit_thread_footerInit_thread_headerSection$EnterLeave
                                                                                                                                                                                                                                                                                              • String ID: <:
                                                                                                                                                                                                                                                                                              • API String ID: 2234156424-1372468433
                                                                                                                                                                                                                                                                                              • Opcode ID: 471c8ecc92a209f5ffb46d202d4aa6d5398a02ee1419f0ee36d653cb764656a2
                                                                                                                                                                                                                                                                                              • Instruction ID: 6cb0e918e637d4d46782a39d418b17b1d8ecca966f24f198388bc7a9b7aeec8e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 471c8ecc92a209f5ffb46d202d4aa6d5398a02ee1419f0ee36d653cb764656a2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F2102B5A003519FC312EF68FD4BB65B3A8FB46730F11826AF81557395D7316A50CB81
                                                                                                                                                                                                                                                                                              Function 00354AC2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,00354B83,0038C2C4,0038C2BC,00000000,00000011,?,00354A1C,00000002,FlsGetValue,0038C2BC,0038C2C4,00000011), ref: 00354B52
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FreeLibrary
                                                                                                                                                                                                                                                                                              • String ID: api-ms-
                                                                                                                                                                                                                                                                                              • API String ID: 3664257935-2084034818
                                                                                                                                                                                                                                                                                              • Opcode ID: ab8ccdb749933aab08d4c1a32932bc4aa2c55b86374f29bbe3046cd6b85f39b3
                                                                                                                                                                                                                                                                                              • Instruction ID: 38091ddb3b408713e2c61adc1a88e58d7dba890122b4e86741d68bec5c76d7c1
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ab8ccdb749933aab08d4c1a32932bc4aa2c55b86374f29bbe3046cd6b85f39b3
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B11C631A40621ABDB278B68AC45F5973AC9F0177AF260212FD51EB2E0E770ED448AD5
                                                                                                                                                                                                                                                                                              Function 002EE4D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57registryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • RegisterClassExW.USER32(00000030), ref: 002EE536
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ClassRegister
                                                                                                                                                                                                                                                                                              • String ID: ../../base/win/message_window.cc$D37$Failed to register the window class for a message-only window$MZx
                                                                                                                                                                                                                                                                                              • API String ID: 2764894006-36649967
                                                                                                                                                                                                                                                                                              • Opcode ID: e5a49e8ac838a4c6898e59e25c776c314628b25b58d5ef1e5831c2ce7a508856
                                                                                                                                                                                                                                                                                              • Instruction ID: 9097167b2b65754d868eb33f00e07a1076ce138aa4a7e19ed40141a3ca328ec8
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e5a49e8ac838a4c6898e59e25c776c314628b25b58d5ef1e5831c2ce7a508856
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E112BB0D10348A7DF11EFA4D816BEEB7B8AF44344F408419F5087B281EFB54648CB95
                                                                                                                                                                                                                                                                                              Function 0022E780 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E7E4
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E81D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: %a %b %d %H:%M:%S %Y$8:$8:
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-4219439470
                                                                                                                                                                                                                                                                                              • Opcode ID: 00f3bcb0e6449860f566702fd03bc01548d44cbca94c21f73d701ced44af8561
                                                                                                                                                                                                                                                                                              • Instruction ID: bf563767f6e5f00a01e682b000fd3d7c763812f73e20769c213f96b2330d3188
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 00f3bcb0e6449860f566702fd03bc01548d44cbca94c21f73d701ced44af8561
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE0122B59002109FD312EF98E846F65B7BCFB02B20F10423AF4154B391D336A914DA92
                                                                                                                                                                                                                                                                                              Function 0027C350 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 24COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0027C37C
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0027C3AB
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: dummy_histogram$pP:$pP:
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-3883108194
                                                                                                                                                                                                                                                                                              • Opcode ID: 7834e418fb95d0e15975162608ee59b315fe860588d93384747c1d1bc663528b
                                                                                                                                                                                                                                                                                              • Instruction ID: 009c62ac4211d211261432a3508452b2e5ee0c6debb36923f404b6274ae1c15c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7834e418fb95d0e15975162608ee59b315fe860588d93384747c1d1bc663528b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F7F0E574650E01CBC223EB28BC52E183355F747714F518279D5050A3A3C7716C618EE2
                                                                                                                                                                                                                                                                                              Function 0020C972 Relevance: 7.6, APIs: 5, Instructions: 110registryCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • RegOpenKeyExW.ADVAPI32(C569482A,?,00000000,?,?), ref: 0020C9BE
                                                                                                                                                                                                                                                                                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 0020CA2E
                                                                                                                                                                                                                                                                                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,00000100,00000000,00000000,00000000,?), ref: 0020CA79
                                                                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?), ref: 0020CA94
                                                                                                                                                                                                                                                                                              • RegCloseKey.ADVAPI32(?,?), ref: 0020CAC5
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseEnum$Open
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 956018044-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 419930b22eaea354c029a12e89fcf87a8ef67c15c1c81a4cf03f56ca7c1d8ca9
                                                                                                                                                                                                                                                                                              • Instruction ID: 5bcc2b06c230cf7bc8c88cbcc0710c6fd0e581f53c4b86f46867627f20ec7b88
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 419930b22eaea354c029a12e89fcf87a8ef67c15c1c81a4cf03f56ca7c1d8ca9
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF4170B194122CABDB20CF65DC8CBEABBBCEF59350F104195E40997241D6709E85CFE0
                                                                                                                                                                                                                                                                                              Function 00208624 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 422COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID: %.2x$%.8lx$,%.2x
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-2969256346
                                                                                                                                                                                                                                                                                              • Opcode ID: 11dd10ed7aa87129387a76ba3bfc5a1706f2d405a858bf79e55ce6c74ffccabf
                                                                                                                                                                                                                                                                                              • Instruction ID: 4e709d6c29a52438550351c9d821145a9ea14dbb5e7625ba740997fd4b2fb67b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 11dd10ed7aa87129387a76ba3bfc5a1706f2d405a858bf79e55ce6c74ffccabf
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3DF1C3B15183819FD711DF64C88062BFBE4BF99314F044A2EF8C597292EB71E954CB52
                                                                                                                                                                                                                                                                                              Function 0034EEF6 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 375COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: __freea
                                                                                                                                                                                                                                                                                              • String ID: a/p$am/pm
                                                                                                                                                                                                                                                                                              • API String ID: 240046367-3206640213
                                                                                                                                                                                                                                                                                              • Opcode ID: 09627d79767595687faf35cbdd763cd9dd6a8c657d97f58996cd853e099bbaf4
                                                                                                                                                                                                                                                                                              • Instruction ID: 2c247b20a4b920bd05bb74002acb7a1905676cd41dcdc1c3583c1d4077c4d37f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 09627d79767595687faf35cbdd763cd9dd6a8c657d97f58996cd853e099bbaf4
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 76C10239A00216DFCB269FA8C585ABAB7F4FF49304F2E4169E801AF651D371BD41CB61
                                                                                                                                                                                                                                                                                              Function 002C2D40 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(?), ref: 002C311F
                                                                                                                                                                                                                                                                                                • Part of subcall function 002B0690: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,002C92E1,00000001,00000001), ref: 002B06B0
                                                                                                                                                                                                                                                                                                • Part of subcall function 002B0690: GetLastError.KERNEL32(?,?,002C92E1,00000001,00000001), ref: 002B06C2
                                                                                                                                                                                                                                                                                                • Part of subcall function 002B0690: SetLastError.KERNEL32(00000000,?,?,002C92E1,00000001,00000001), ref: 002B06F9
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(?), ref: 002C31D4
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorExclusiveLastLock$AcquireCreateEventRelease
                                                                                                                                                                                                                                                                                              • String ID: $2
                                                                                                                                                                                                                                                                                              • API String ID: 629145919-4264767444
                                                                                                                                                                                                                                                                                              • Opcode ID: 0fa06d7f4b3e3c3c054ec532378aedf44843ad781d1e26d98c554be0922a996f
                                                                                                                                                                                                                                                                                              • Instruction ID: 130ac30f707505ba76ac6962759d620a205681de7c81f6ef9fb920a233228aa5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0fa06d7f4b3e3c3c054ec532378aedf44843ad781d1e26d98c554be0922a996f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4DE1E3B18147448FE711DF24C885BABFBF4BF95304F008A1DE89A5B241DBB1E598CB91
                                                                                                                                                                                                                                                                                              Function 00278540 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 227COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(?,?), ref: 0027858B
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 002785AD
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                                                                                              • String ID: ess-$phas
                                                                                                                                                                                                                                                                                              • API String ID: 17069307-415257544
                                                                                                                                                                                                                                                                                              • Opcode ID: 217632c9771e03f3a7eacafbdd3d85e6a03cbb9b2afda67b097c15d8b8ca4f7a
                                                                                                                                                                                                                                                                                              • Instruction ID: b42005fbfd605df47a4b55583c69d1631bb071fd5057ed59cd32f0f520de7e0d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 217632c9771e03f3a7eacafbdd3d85e6a03cbb9b2afda67b097c15d8b8ca4f7a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC91BEB05243429FDB14DF14C889A6BB7E5FFC8310F548A1DF89A9B291DB70E914CB92
                                                                                                                                                                                                                                                                                              Function 00252750 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetLongPathNameW.KERNEL32(?,?,00000104), ref: 00252939
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: LongNamePath
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_util_win.cc$.tmp$CreateAndOpenTemporaryFileInDir
                                                                                                                                                                                                                                                                                              • API String ID: 82841172-836254879
                                                                                                                                                                                                                                                                                              • Opcode ID: 8c8b88ef84c4801eb226402c920625d62d9db41a3c8e00bd26c2ecaff97b0fda
                                                                                                                                                                                                                                                                                              • Instruction ID: 67473a3e4aadd90e9abffd74982edce7f32bb19130d8a60958a1dd2f2db72412
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8c8b88ef84c4801eb226402c920625d62d9db41a3c8e00bd26c2ecaff97b0fda
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BC5104B1928385AFDB11EF20C885A6FB7A4AFD6324F044A1DF8D1172D2DB70D958CB52
                                                                                                                                                                                                                                                                                              Function 002B8CD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID: %s%zu$restart_cmd_line_key_
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-2004224652
                                                                                                                                                                                                                                                                                              • Opcode ID: e51c191205c0e5b51731007d1b6e9fa1ae318619bea94761e202a5803e30cabb
                                                                                                                                                                                                                                                                                              • Instruction ID: 5b18f22919df2602ae4dc88f1a0b7b486340bc75ace11fdd04a657feb2d98c62
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e51c191205c0e5b51731007d1b6e9fa1ae318619bea94761e202a5803e30cabb
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 384147B16102065FDB10DF38DC81AAA77ECAF51764F14452EF8599B382EB70AD15C7A0
                                                                                                                                                                                                                                                                                              Function 00206354 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,?), ref: 00206454
                                                                                                                                                                                                                                                                                              • RemoveDirectoryW.KERNEL32(?,?,?), ref: 00206499
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • Actual removal of , xrefs: 002063A9
                                                                                                                                                                                                                                                                                              • ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc, xrefs: 0020637A, 00206397
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: DirectoryRemove
                                                                                                                                                                                                                                                                                              • String ID: ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc$Actual removal of
                                                                                                                                                                                                                                                                                              • API String ID: 597925465-678036363
                                                                                                                                                                                                                                                                                              • Opcode ID: 23a00147298fc56c0f4c1003ae1000fa49ceb55165bd8c3450c39652019bf810
                                                                                                                                                                                                                                                                                              • Instruction ID: 1738a407845c3164929df905058c18c3cbd9bf2ae6e619053b92738563315e17
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 23a00147298fc56c0f4c1003ae1000fa49ceb55165bd8c3450c39652019bf810
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44411BB0A103149BDF65EF20DC45BBA3365AF05704F00049DE909972D3DB34AA79CF91
                                                                                                                                                                                                                                                                                              Function 002543D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileInformationByHandle.KERNEL32(?,?), ref: 00254499
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileHandleInformation
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_win.cc$File::GetInfo$GetInfo
                                                                                                                                                                                                                                                                                              • API String ID: 3935143524-2616935691
                                                                                                                                                                                                                                                                                              • Opcode ID: e568663423cbd6fe24cfc9cb0845ae2394e69f347b2588eb0b988f1f6d53028c
                                                                                                                                                                                                                                                                                              • Instruction ID: b3350f25667c5ac2122fe51b0312a08c5241369cac09885079ca7d9930b701f8
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e568663423cbd6fe24cfc9cb0845ae2394e69f347b2588eb0b988f1f6d53028c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 94419071818782ABC311DF28CC41A9AFBB4BFDA360F104B1DF9D456191EB7191A5CB82
                                                                                                                                                                                                                                                                                              Function 00254030 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,00000000,FFFFFFFF,00000000), ref: 002540E8
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileWrite
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_win.cc$File::WriteAtCurrentPos$WriteAtCurrentPos
                                                                                                                                                                                                                                                                                              • API String ID: 3934441357-2300577854
                                                                                                                                                                                                                                                                                              • Opcode ID: f876cf78832670700d5be909b15973087932caa0282412ac58f9fbd6046bbaf2
                                                                                                                                                                                                                                                                                              • Instruction ID: cf1cb0d09c7d5a207b64e4854c828959e9a7773cc3aafb804227779d2248e6f3
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f876cf78832670700d5be909b15973087932caa0282412ac58f9fbd6046bbaf2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B9219C714247819BD210EF248C41A6AF7A8EFC5774F108B1DF9E4161C1EB7096188B92
                                                                                                                                                                                                                                                                                              Function 0027A060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,0027CCAA,00000000,5D8B087E,00000004), ref: 0027A0C0
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?), ref: 0027A0F0
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                                                                                              • String ID: `P:$`P:
                                                                                                                                                                                                                                                                                              • API String ID: 17069307-3941944548
                                                                                                                                                                                                                                                                                              • Opcode ID: a9d6d8cc66237b6ef5b196c9ce1103172e4625c150e6fde728ecee0a07217c01
                                                                                                                                                                                                                                                                                              • Instruction ID: 395ec58d86fe162873c8e63c916de6cc2817417151db75a0409f938c80afec54
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a9d6d8cc66237b6ef5b196c9ce1103172e4625c150e6fde728ecee0a07217c01
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5111E9B1A116189BD601FF549C52AAF732DEB81310F498425F90D5B243D6719D248BD2
                                                                                                                                                                                                                                                                                              Function 00240510 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00000000), ref: 00240578
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(00000000), ref: 00240594
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                                                                                              • String ID: P?:$P?:
                                                                                                                                                                                                                                                                                              • API String ID: 17069307-2101003969
                                                                                                                                                                                                                                                                                              • Opcode ID: fe8f416997f5d67efc24b2b5936739a2d56928605d5d0e93648b6f9971cc93ca
                                                                                                                                                                                                                                                                                              • Instruction ID: e97b9aff370bbeb3496dc8acfe7883868470fb1a964656f5310eb7c67883515d
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe8f416997f5d67efc24b2b5936739a2d56928605d5d0e93648b6f9971cc93ca
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A2213570F202059FC715AF25DC81A3EB3B9FF42B10F844469F50997281DB30E9518F51
                                                                                                                                                                                                                                                                                              Function 0027A580 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,?,0023DC1C,0023F8D0,C7087D8B), ref: 0027A5FC
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,0023DC1C,0023F8D0,C7087D8B), ref: 0027A62D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                                                                                              • String ID: `P:$`P:
                                                                                                                                                                                                                                                                                              • API String ID: 17069307-3941944548
                                                                                                                                                                                                                                                                                              • Opcode ID: fe933d295758bdae17bf01616169a831b3b245da70fd2bddd7e7df715f6ac976
                                                                                                                                                                                                                                                                                              • Instruction ID: 12c0033400a45ab3797443903cefc1741476d676633029f76b78ce54acf6ea08
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe933d295758bdae17bf01616169a831b3b245da70fd2bddd7e7df715f6ac976
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 451106B0F106099B8B01FF64D8129AF7379EFC2320F49C015E8096B282DA7099218BD2
                                                                                                                                                                                                                                                                                              Function 00254130 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFileSizeEx.KERNEL32(00000000,FFFFFFFF), ref: 002541E2
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileSize
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_win.cc$File::GetLength$GetLength
                                                                                                                                                                                                                                                                                              • API String ID: 3433856609-2366038222
                                                                                                                                                                                                                                                                                              • Opcode ID: 840b5c553df97f3ac90a6b8d38a5d41388ad397369d87e7300467bf7b8a298db
                                                                                                                                                                                                                                                                                              • Instruction ID: e1d1809d87bf5e8daaf999638fe2f5fc556e8f4ea38eb56c1246de95cd16963e
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 840b5c553df97f3ac90a6b8d38a5d41388ad397369d87e7300467bf7b8a298db
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E216D715243819BD220EF68CC42A6EF7A4BFC9770F508B1DF5E4571D1DBB096198B82
                                                                                                                                                                                                                                                                                              Function 0027A830 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,00360DCC,?,?,0023DCB0,00000000), ref: 0027A882
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(00000000,?,0023DCB0,00000000), ref: 0027A8AF
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                                                                                              • String ID: `P:$`P:
                                                                                                                                                                                                                                                                                              • API String ID: 17069307-3941944548
                                                                                                                                                                                                                                                                                              • Opcode ID: 4f167003dd518af22a6a27b20486ced018a0f39cb8a94aac7914556e51140b94
                                                                                                                                                                                                                                                                                              • Instruction ID: 3fc9dedcff59dcbb1ad0eb5f7034ab2f8ce8bfd8d950e450395169dde411138c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f167003dd518af22a6a27b20486ced018a0f39cb8a94aac7914556e51140b94
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2101F7B1B71A149BDB02EF509C46A9D7358FB42720F098020F90A67353CAB29C218BE7
                                                                                                                                                                                                                                                                                              Function 0027A7B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • TryAcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,0027D2FE,?,?), ref: 0027A802
                                                                                                                                                                                                                                                                                              • ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,0027D2FE,?,?), ref: 0027A81A
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                                                                                              • String ID: `P:$`P:
                                                                                                                                                                                                                                                                                              • API String ID: 17069307-3941944548
                                                                                                                                                                                                                                                                                              • Opcode ID: fefdbcf7b4e4b93def204fc27f9a74362f4e97986c06eefacf29934c9b0a58bb
                                                                                                                                                                                                                                                                                              • Instruction ID: a8d73c15f871edfdcc2227ed29ed146391b2c8cf087ab46915646a959e15f19f
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fefdbcf7b4e4b93def204fc27f9a74362f4e97986c06eefacf29934c9b0a58bb
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C6F0F6B6B60E149B8512FF549C06A5E7318EAC3730F098021F90867383D6A56C224AE7
                                                                                                                                                                                                                                                                                              Function 00208BB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 00208BF6
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 00208C31
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: L2:$P2:
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-3564396008
                                                                                                                                                                                                                                                                                              • Opcode ID: 3692bcbb341b376c3e77f8b1584aff5e578294b65a0e5bdb702ae8799a9551f6
                                                                                                                                                                                                                                                                                              • Instruction ID: 356e56d2b035204ba638a1ecb2cbc7101aa7546d4cab39a5d3554cbf4198c280
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3692bcbb341b376c3e77f8b1584aff5e578294b65a0e5bdb702ae8799a9551f6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D001D674A40309EFC712EB5CEC53F9AB368EF86704F004525F9454B2D2F7756B199A42
                                                                                                                                                                                                                                                                                              Function 00294DF0 Relevance: 6.2, APIs: 4, Instructions: 207COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 715f182307335c7a9d364302a9f544c72a474e4a5c3e9395234433abe7f7d4ab
                                                                                                                                                                                                                                                                                              • Instruction ID: b27b04a51def08ea48ffdeeef7e0922f894517ede95ebfde39549d14ba01fb12
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 715f182307335c7a9d364302a9f544c72a474e4a5c3e9395234433abe7f7d4ab
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A561D0B5A142178FDF11EE64EC80EBB77A5BF41308F190868E8559B301E775EC26CB61
                                                                                                                                                                                                                                                                                              Function 0025A4E0 Relevance: 6.1, APIs: 4, Instructions: 85COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • QueryPerformanceCounter.KERNEL32(00000000), ref: 0025A50F
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0025A54C
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0025A56A
                                                                                                                                                                                                                                                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0025A5C1
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CounterPerformanceQuery
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 374826692-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 42c8edd73830555065c386e094ed869d4bcb4265bc8ca361bbd234c8df3555b0
                                                                                                                                                                                                                                                                                              • Instruction ID: 75f3dd0d8f290a7d4b4db4f20ff76261e678049603681b205c62685aced3cee2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 42c8edd73830555065c386e094ed869d4bcb4265bc8ca361bbd234c8df3555b0
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 31317F71604300AFC708DF59D896A2BFBEDEBC9720F04C92EB958C7361DA74D8448B92
                                                                                                                                                                                                                                                                                              Function 0022E180 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E1E5
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E247
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E259
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: EnterCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 003294F2
                                                                                                                                                                                                                                                                                                • Part of subcall function 003294E7: LeaveCriticalSection.KERNEL32(003A4FC0,?,?,?,0028EFCF,003A5134,?,?,?,?,0028EBD1,00000000,00000000), ref: 0032952F
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E292
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CriticalInit_thread_footerInit_thread_headerSection$EnterLeave
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2234156424-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 1231a8390fe4f4ce3c5b5e79be586859828cdedc606c928561e4ab24163d5ac2
                                                                                                                                                                                                                                                                                              • Instruction ID: ef66a0366d996bfa8d4db4a9e9b52b2aa842cefaffa06ebf7d4069d7b8dc37ba
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1231a8390fe4f4ce3c5b5e79be586859828cdedc606c928561e4ab24163d5ac2
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 462102B5A40250EFD722EF98FD47B65B7A8FB42B20F11423AF8095B391D7351A50CA92
                                                                                                                                                                                                                                                                                              Function 002B0690 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,002C92E1,00000001,00000001), ref: 002B06B0
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,?,002C92E1,00000001,00000001), ref: 002B06C2
                                                                                                                                                                                                                                                                                              • SetLastError.KERNEL32(00000000,?,?,002C92E1,00000001,00000001), ref: 002B06F9
                                                                                                                                                                                                                                                                                                • Part of subcall function 00258370: GetHandleVerifier.ASSISTANT_INSTALLER(?,?,0025631A,?,00000000,?,003A4CF8,?,?,?,?,0025648D,00000000), ref: 00258377
                                                                                                                                                                                                                                                                                              • ResetEvent.KERNEL32(?,?,?,?,002C92E1,00000001,00000001), ref: 002B0725
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorEventLast$CreateHandleResetVerifier
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 794520543-0
                                                                                                                                                                                                                                                                                              • Opcode ID: fc60a0436ef18157778530c27bd8e598cc3d6dccbb072f429216c67228ac79c9
                                                                                                                                                                                                                                                                                              • Instruction ID: 4551312a4461bbb6a307bb585f2287f2c54f373541c428e553f41e3f1cc93be5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc60a0436ef18157778530c27bd8e598cc3d6dccbb072f429216c67228ac79c9
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 71112676110304AFE7116F34DC4978ABBDDEB44392F10482AF581C3250EBB6E860CF52
                                                                                                                                                                                                                                                                                              Function 00340543 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFullPathNameW.KERNEL32(?,?,?,00000000,0034053E,00000000,?,0034F836,002410E1,002410E1,?,?,002410E1,002410E1,00000001,00000000), ref: 00340559
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,0034F836,002410E1,002410E1,?,?,002410E1,002410E1,00000001,00000000,00000000,?,0034053E,002410E1,00251595,?), ref: 00340563
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 0034056A
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFullLastNamePath__dosmaperr
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2398240785-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7ad2700c2677dc95e04becb959a1dc145e0aaa423c81fc14e5e754ba9353e114
                                                                                                                                                                                                                                                                                              • Instruction ID: aa5c71b16d09b641d61fe5396ca5ab8f38236044baae33384ef530842db92f86
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7ad2700c2677dc95e04becb959a1dc145e0aaa423c81fc14e5e754ba9353e114
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FEF0A932604515BB8B262FA6CC48D5ABFADFF453A0B058651F618DE020CB32E860DFE0
                                                                                                                                                                                                                                                                                              Function 003405FE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetFullPathNameW.KERNEL32(?,?,?,00000000,0034053E,00000000,?,0034F7C1,002410E1,002410E1,0034053E,?,?,002410E1,002410E1,00000001), ref: 00340614
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,0034F7C1,002410E1,002410E1,0034053E,?,?,002410E1,002410E1,00000001,00000000,00000000,?,0034053E,002410E1,00251595), ref: 0034061E
                                                                                                                                                                                                                                                                                              • __dosmaperr.LIBCMT ref: 00340625
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ErrorFullLastNamePath__dosmaperr
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2398240785-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 18c78a04b7b495ca15a0eb839f3113ad8320cc99b8e7b148423da04d2153c27a
                                                                                                                                                                                                                                                                                              • Instruction ID: 992aa6e2acc46cafbff52067c78fb0ecff18770adf9795ce6757934d3a3c09de
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 18c78a04b7b495ca15a0eb839f3113ad8320cc99b8e7b148423da04d2153c27a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 94F06231200515BB8B261FA6DC44C5AFFADFF843607064515F519CE420CB36E871DBD1
                                                                                                                                                                                                                                                                                              Function 00356499 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0034F865,00000000,00000001,00000000,00000000,?,00340D7B,?,?,00000000), ref: 003564B0
                                                                                                                                                                                                                                                                                              • GetLastError.KERNEL32(?,0034F865,00000000,00000001,00000000,00000000,?,00340D7B,?,?,00000000,?,00000000,?,0034080F,00000000), ref: 003564BC
                                                                                                                                                                                                                                                                                                • Part of subcall function 00356510: CloseHandle.KERNEL32(FFFFFFFE,003564CC,?,0034F865,00000000,00000001,00000000,00000000,?,00340D7B,?,?,00000000,?,00000000), ref: 00356520
                                                                                                                                                                                                                                                                                              • ___initconout.LIBCMT ref: 003564CC
                                                                                                                                                                                                                                                                                                • Part of subcall function 003564EE: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0035648A,0034F852,00000000,?,00340D7B,?,?,00000000,?), ref: 00356501
                                                                                                                                                                                                                                                                                              • WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0034F865,00000000,00000001,00000000,00000000,?,00340D7B,?,?,00000000,?), ref: 003564E1
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                                                                                              • API String ID: 2744216297-0
                                                                                                                                                                                                                                                                                              • Opcode ID: 7940e197b508eb309f907bc0c4170ca8b1d4109b93708070b6e17c804592b325
                                                                                                                                                                                                                                                                                              • Instruction ID: 9102dfa9c1dc3f9e2868ef9e41fe6deb83431663d710323fcaa895806618a46c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7940e197b508eb309f907bc0c4170ca8b1d4109b93708070b6e17c804592b325
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 30F01C36400519BBCF231F96DC05D8E3F2AFB093A1F454511FE1886530DA72CC609B92
                                                                                                                                                                                                                                                                                              Function 0024A770 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 295COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID: ScopedBlockingCall
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-1243657212
                                                                                                                                                                                                                                                                                              • Opcode ID: 1f93bcfb4712ae2e2def02efc47e44a4fecdb14cbf8dabfbd3a9018f11cd7a71
                                                                                                                                                                                                                                                                                              • Instruction ID: 9b9d6cfcacc53eac755f9d8750dd0ecc36fb8b04d0f65aa335aeaa5ab35baa58
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f93bcfb4712ae2e2def02efc47e44a4fecdb14cbf8dabfbd3a9018f11cd7a71
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 28B19DB0610B019FD724DF29C980B27B7E6BF58320F548A2DE49A8BB91D770F815CB91
                                                                                                                                                                                                                                                                                              Function 0024AAD0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 295COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ScopedBlockingCallWithBaseSyncPrimitives, xrefs: 0024AB14
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen
                                                                                                                                                                                                                                                                                              • String ID: ScopedBlockingCallWithBaseSyncPrimitives
                                                                                                                                                                                                                                                                                              • API String ID: 4218353326-1856630658
                                                                                                                                                                                                                                                                                              • Opcode ID: 05bc4723c752780b0af5a969353e8c6634efa71e5df4f6a759f402d78fb423cd
                                                                                                                                                                                                                                                                                              • Instruction ID: 40a13ff1a3d489269c9f1035d3114297e86c349ddf85e0a362fc749471a97f29
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 05bc4723c752780b0af5a969353e8c6634efa71e5df4f6a759f402d78fb423cd
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EBB1ADB0610B019FD724DF29C980B27B7E6FF58324F548A2DE49A8BB91D770F8148B91
                                                                                                                                                                                                                                                                                              Function 00252A00 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 263COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00252D05
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • CreateTemporaryDirInDir, xrefs: 00252A57
                                                                                                                                                                                                                                                                                              • ../../base/files/file_util_win.cc, xrefs: 00252A52
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateDirectory
                                                                                                                                                                                                                                                                                              • String ID: ../../base/files/file_util_win.cc$CreateTemporaryDirInDir
                                                                                                                                                                                                                                                                                              • API String ID: 4241100979-140310067
                                                                                                                                                                                                                                                                                              • Opcode ID: c2d91b9178df9d51fe8e8f2edab8ec85c16dc5b9eec63d49d39a59f5ef4b2135
                                                                                                                                                                                                                                                                                              • Instruction ID: cf3e8843c827f47d63214748346d49e7d9c545266f1ff8b99e56d251c01dcdd5
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c2d91b9178df9d51fe8e8f2edab8ec85c16dc5b9eec63d49d39a59f5ef4b2135
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4FA1DEB1528380ABD711DF20C881B6FBBE4AFD6318F040A1DF8D567291DB75A61C8B97
                                                                                                                                                                                                                                                                                              Function 001FCC90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 001FCD83
                                                                                                                                                                                                                                                                                                • Part of subcall function 0033D9B4: IsProcessorFeaturePresent.KERNEL32(00000017,00346F16,?,0033C03F,?,?,?,00000000,?,?,001FCEDF,?,?,?,0022EE62,?), ref: 0033D9D0
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FeaturePresentProcessor_strlen
                                                                                                                                                                                                                                                                                              • String ID: ... (message truncated)$[%s : %d] RAW:
                                                                                                                                                                                                                                                                                              • API String ID: 2631407230-3262997248
                                                                                                                                                                                                                                                                                              • Opcode ID: a53f4672620a64cb1e3e542c413652d8b4f44046ae43abeabe8d1e58f2d5415a
                                                                                                                                                                                                                                                                                              • Instruction ID: 5a9372a409f9fa14daac8602cf7e29abcac048c2980a0ed1b467fc3a0c638914
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a53f4672620a64cb1e3e542c413652d8b4f44046ae43abeabe8d1e58f2d5415a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A651D472A0021DAFDB15EF64DC82EEB7BA9EF45314F044069FA099B251DB319A14CBE0
                                                                                                                                                                                                                                                                                              Function 00292E80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 00292F5F
                                                                                                                                                                                                                                                                                              • _strlen.LIBCMT ref: 00292F95
                                                                                                                                                                                                                                                                                                • Part of subcall function 002D48D0: EventUnregister.ADVAPI32(?,?,00000000,?,00292F09,Google.Chrome,00368194,00292FF0,00000000), ref: 002D48E4
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: _strlen$EventUnregister
                                                                                                                                                                                                                                                                                              • String ID: Google.Chrome
                                                                                                                                                                                                                                                                                              • API String ID: 303537305-2537414952
                                                                                                                                                                                                                                                                                              • Opcode ID: 1260d6b4cf9d57d7b9ce01ddfa83b959334205c362fda828003d5610813b2f6b
                                                                                                                                                                                                                                                                                              • Instruction ID: e4e8ca72c91b1285062e5ec7776162572b7f9956dcd1b33b5ee9db50111d637c
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1260d6b4cf9d57d7b9ce01ddfa83b959334205c362fda828003d5610813b2f6b
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36415EB1D012189FDF05DF94D881BDEBBF4BF49314F14816AE405AB241DB759A46CBA0
                                                                                                                                                                                                                                                                                              Function 00210410 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                                • Part of subcall function 0021051B: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,0021043C,SeTakeOwnershipPrivilege), ref: 0021053C
                                                                                                                                                                                                                                                                                                • Part of subcall function 0021051B: OpenProcessToken.ADVAPI32(00000000,00000020,?,?,?,?,?,?,?,?,?,0021043C,SeTakeOwnershipPrivilege), ref: 00210546
                                                                                                                                                                                                                                                                                                • Part of subcall function 0021051B: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00210577
                                                                                                                                                                                                                                                                                                • Part of subcall function 0021051B: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0021043C,SeTakeOwnershipPrivilege), ref: 002105A9
                                                                                                                                                                                                                                                                                                • Part of subcall function 0021051B: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0021043C,SeTakeOwnershipPrivilege), ref: 002105B3
                                                                                                                                                                                                                                                                                              • SetNamedSecurityInfoW.ADVAPI32(?,?,00000001,00000000,00000000,00000000,00000000,SeTakeOwnershipPrivilege), ref: 00210489
                                                                                                                                                                                                                                                                                              • LocalFree.KERNEL32(?,SeTakeOwnershipPrivilege), ref: 002104D2
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ProcessToken$AdjustCurrentErrorFreeInfoLastLocalLookupNamedOpenPrivilegePrivilegesSecurityValue
                                                                                                                                                                                                                                                                                              • String ID: SeTakeOwnershipPrivilege
                                                                                                                                                                                                                                                                                              • API String ID: 3132948474-3375656754
                                                                                                                                                                                                                                                                                              • Opcode ID: a11212e17f3fdac84cd7b378fe6e33a422d2b626f27a4f7c1152dc16bc9a2447
                                                                                                                                                                                                                                                                                              • Instruction ID: 187b08b3134fb9126be68f3bcc5f22b41f8db953f4e32924f7c08f5fb0b5dfcb
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a11212e17f3fdac84cd7b378fe6e33a422d2b626f27a4f7c1152dc16bc9a2447
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7431F870F002196BDF11BB61DC81AFFB7A6AF94310F048029FD52A7281CFB169968AD1
                                                                                                                                                                                                                                                                                              Function 002EA615 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 002EA68A
                                                                                                                                                                                                                                                                                              • CreateFile , xrefs: 002EA69C
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$CreateFile
                                                                                                                                                                                                                                                                                              • API String ID: 823142352-2196637939
                                                                                                                                                                                                                                                                                              • Opcode ID: f59668411ed84ef4f35ddcceedea919109a625b384e1d26353090d336100cce5
                                                                                                                                                                                                                                                                                              • Instruction ID: dd220e7d0a517eb90922c325d4538b3b09ffd610e270f353ed2035ee5c38e478
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f59668411ed84ef4f35ddcceedea919109a625b384e1d26353090d336100cce5
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C821BEB19042549BEF11FF24DC52FBAB774AF55300F4441A9F948AB182E7316E54CF62
                                                                                                                                                                                                                                                                                              Function 002EA927 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • LockFileEx.KERNEL32(00000000,8408C483,00000000,-00000001,-00000001,?), ref: 002EA96B
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • LockFileEx, xrefs: 002EA9A8
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 002EA998
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileLock
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$LockFileEx
                                                                                                                                                                                                                                                                                              • API String ID: 3169042693-1251665049
                                                                                                                                                                                                                                                                                              • Opcode ID: 8b2471c3353e562e114c4d8e614dd5bdea2e4964aa97d870cfd524f18e80454a
                                                                                                                                                                                                                                                                                              • Instruction ID: 7fdc228ab257f3f2aedca04a3981a9a5dfaedbdb96b5badc2f193c01f9e7ddc9
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8b2471c3353e562e114c4d8e614dd5bdea2e4964aa97d870cfd524f18e80454a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C7115C72A1034477E730AB268C17FEBB7ADDFC4710F41C629FD495B282EB3059048692
                                                                                                                                                                                                                                                                                              Function 002B0760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63synchronizationCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 002B0802
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • Wait, xrefs: 002B07CA
                                                                                                                                                                                                                                                                                              • ../../base/synchronization/waitable_event_win.cc, xrefs: 002B07C5
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ObjectSingleWait
                                                                                                                                                                                                                                                                                              • String ID: ../../base/synchronization/waitable_event_win.cc$Wait
                                                                                                                                                                                                                                                                                              • API String ID: 24740636-241924016
                                                                                                                                                                                                                                                                                              • Opcode ID: 8c8bec0f59363fa7e145e951479dd91560a0b6b2858b5654d05fd79843f9066a
                                                                                                                                                                                                                                                                                              • Instruction ID: be103e35fe771a4651236d25dd3250b7a4923d127d84af16f33c52408475588b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8c8bec0f59363fa7e145e951479dd91560a0b6b2858b5654d05fd79843f9066a
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C42190318183C19AE312DB288846BAFFB94AFD6354F544B1DF4D016192DBE49A99C7C3
                                                                                                                                                                                                                                                                                              Function 002EA9DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60fileCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • UnlockFileEx.KERNEL32(002B83D0,00000000,-00000001,-00000001,?), ref: 002EAA15
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • UnlockFileEx, xrefs: 002EAA52
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 002EAA42
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: FileUnlock
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$UnlockFileEx
                                                                                                                                                                                                                                                                                              • API String ID: 45017762-3846138344
                                                                                                                                                                                                                                                                                              • Opcode ID: 87eaf28ec0ee4d074c90c12fdbd64692019515e32efc50e1c6af5e9dbcf3a0b6
                                                                                                                                                                                                                                                                                              • Instruction ID: bc4d1c2ea0cc495f4b81816e33443f8ab975e65fa2602366d9e29d214edc6867
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 87eaf28ec0ee4d074c90c12fdbd64692019515e32efc50e1c6af5e9dbcf3a0b6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9118C72A1030467E724AB299C07FFBB75DDFC4710F00422AF8095B381EB70590486D2
                                                                                                                                                                                                                                                                                              Function 0022E400 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E464
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E49D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: %m/%d/%y
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-2272391455
                                                                                                                                                                                                                                                                                              • Opcode ID: 9659b4922df518bb4cddc7fbf537a97ea2c12a79fb4442398ef4ff727d9aaa44
                                                                                                                                                                                                                                                                                              • Instruction ID: 2050e7519b739492a28fd7ec3c2ddcf3d8d0b20302f0a1d74a0478c22a896bcc
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9659b4922df518bb4cddc7fbf537a97ea2c12a79fb4442398ef4ff727d9aaa44
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA01C4B1E00650DFD311EF98E846B55B7B8FB46720F114176F5158B391D3355914CA92
                                                                                                                                                                                                                                                                                              Function 0022E4E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E544
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E57D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: %m/%d/%y
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-2272391455
                                                                                                                                                                                                                                                                                              • Opcode ID: 6d626b8d4cd85f521370c98d46d82a3a6f2e9c77b1798980c6ff1e9da53df8c7
                                                                                                                                                                                                                                                                                              • Instruction ID: fcf94bfb279ff9642a9b119d94a8f808d260587fe01dbb83a141d9ac6b297773
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d626b8d4cd85f521370c98d46d82a3a6f2e9c77b1798980c6ff1e9da53df8c7
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF0149B1910211DFD311EF48F846F59B7B8FB46724F40413AF4254B381E374A918CA91
                                                                                                                                                                                                                                                                                              Function 0022E5C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E624
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E65D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: %H:%M:%S
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-1434664181
                                                                                                                                                                                                                                                                                              • Opcode ID: 2e04ff20725bd0098df70fb2f82bfeffafa1d8c257b25c0eb93b3c43ceef778f
                                                                                                                                                                                                                                                                                              • Instruction ID: 7086a3e6f72dd3104615250859d28e0a27145519898a3ea4166de80ac5dbfd8b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2e04ff20725bd0098df70fb2f82bfeffafa1d8c257b25c0eb93b3c43ceef778f
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1E01D2B1A006119FD312EF98E84AB65B7F8FB52720F00467AF5154B391D33999158B92
                                                                                                                                                                                                                                                                                              Function 0022E6A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E704
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E73D
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: %H:%M:%S
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-1434664181
                                                                                                                                                                                                                                                                                              • Opcode ID: 2be7ea060c3373116b5d499c003c3e153c85db7951538d18cf31ea7c5de8a977
                                                                                                                                                                                                                                                                                              • Instruction ID: 6ad4920a131656f0c90a7a5e1936ca40c5ed1437f0ddc8346c45ec8500aa5f82
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2be7ea060c3373116b5d499c003c3e153c85db7951538d18cf31ea7c5de8a977
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0501D2B2A00654DFD312EF98E946F75B7B8FB46720F00427AF5054B381D7359914CB92
                                                                                                                                                                                                                                                                                              Function 0022E860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E8C4
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E8FD
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: %a %b %d %H:%M:%S %Y
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-1318879718
                                                                                                                                                                                                                                                                                              • Opcode ID: 8ed03df711e7cb0ab0d7e676715785ce6b1ce51221c832a8c88ed2265026ac14
                                                                                                                                                                                                                                                                                              • Instruction ID: 29e2e9643cdf7e37391ca184b963add06a73eb5da83094d1cad2d43cf6c3b48b
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8ed03df711e7cb0ab0d7e676715785ce6b1ce51221c832a8c88ed2265026ac14
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 500122B19003109FC712EF88F847F69B7B8FB46B20F00417AF4054B391D338AA148B92
                                                                                                                                                                                                                                                                                              Function 0022E940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022E9A4
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022E9DD
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: %I:%M:%S %p
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-611667740
                                                                                                                                                                                                                                                                                              • Opcode ID: b41a75aae5148f149c26a61dc2352fa86bb2616e0b39f7c52153ca480a58cdf8
                                                                                                                                                                                                                                                                                              • Instruction ID: e93835110e2e9e487c32ee6f77e6957f44233fcc0e33c2ca71cff5849a72b8e2
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b41a75aae5148f149c26a61dc2352fa86bb2616e0b39f7c52153ca480a58cdf8
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AF01D2B19006549FC312EF98E84ABA6BBA4FB47720F00427AE51A8B391D371A950CA91
                                                                                                                                                                                                                                                                                              Function 0022EA20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • __Init_thread_header.LIBCMT ref: 0022EA84
                                                                                                                                                                                                                                                                                              • __Init_thread_footer.LIBCMT ref: 0022EABD
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                                                                                              • String ID: %I:%M:%S %p
                                                                                                                                                                                                                                                                                              • API String ID: 4092853384-611667740
                                                                                                                                                                                                                                                                                              • Opcode ID: c4630e5f6093b19932a0b7f1aae0cfe2626cdbe48712396b6ff042e6cd72e0b1
                                                                                                                                                                                                                                                                                              • Instruction ID: d7b0be096f2cb4fad388ec7ec9e7c1d39f39a00d851d2c9de597761bd96dfebf
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c4630e5f6093b19932a0b7f1aae0cfe2626cdbe48712396b6ff042e6cd72e0b1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7901F5B5A40650DFC712EF98F846F6AB7A4FB46B20F00427AF9055B392D3B19B50CA91
                                                                                                                                                                                                                                                                                              Function 0026C6D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32(../../third_party/crashpad/crashpad/client/crashpad_client_win.cc,0000032C,00000002), ref: 0026C73B
                                                                                                                                                                                                                                                                                                • Part of subcall function 0026C770: Sleep.KERNEL32(00000001), ref: 0026C795
                                                                                                                                                                                                                                                                                                • Part of subcall function 0026C770: GetCurrentProcess.KERNEL32(../../third_party/crashpad/crashpad/client/crashpad_client_win.cc,000000AF,00000002), ref: 0026C874
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/client/crashpad_client_win.cc, xrefs: 0026C714
                                                                                                                                                                                                                                                                                              • not connected, xrefs: 0026C726
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CurrentProcess$Sleep
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$not connected
                                                                                                                                                                                                                                                                                              • API String ID: 4112775895-3685228723
                                                                                                                                                                                                                                                                                              • Opcode ID: 0b9dcb25f03640a364d6493b7bc1faf486a21320bb17aafc2c3ba164b5cad71c
                                                                                                                                                                                                                                                                                              • Instruction ID: 17707bfefe680636fe0275f85706313a15aec6740b57adabd2182de713a19f07
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0b9dcb25f03640a364d6493b7bc1faf486a21320bb17aafc2c3ba164b5cad71c
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7B014971E2031867DA127B78AC07FBDB61E4F01710F900125F6496A1D2EB3216A48B92
                                                                                                                                                                                                                                                                                              Function 002F8AC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42threadCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,002F8B30,00000000,00000000,00000000), ref: 002F8ADF
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • CreateThread, xrefs: 002F8B18
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/thread/thread_win.cc, xrefs: 002F8B01
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CreateThread
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/thread/thread_win.cc$CreateThread
                                                                                                                                                                                                                                                                                              • API String ID: 2422867632-2064233884
                                                                                                                                                                                                                                                                                              • Opcode ID: 2ca9a9685d17bdec8ffc9e9e40c99da20d120bd3d3ee5cd5d0c7af2ed4216e86
                                                                                                                                                                                                                                                                                              • Instruction ID: 3d3f53849b9ebd25b446ed3be8ff381bd94cffbb27200ad1e91a53ea5a6ed216
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2ca9a9685d17bdec8ffc9e9e40c99da20d120bd3d3ee5cd5d0c7af2ed4216e86
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 15F0F6B1E602187BD60177786C07DBFB75C8B00700F40443AF905A71C1FE64AA144799
                                                                                                                                                                                                                                                                                              Function 002AC802 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • FindClose.KERNEL32(002E9B54,002E9B54,?), ref: 002AC818
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              • ../../third_party/crashpad/crashpad/util/win/scoped_handle.cc, xrefs: 002AC837
                                                                                                                                                                                                                                                                                              • FindClose, xrefs: 002AC84E
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: CloseFind
                                                                                                                                                                                                                                                                                              • String ID: ../../third_party/crashpad/crashpad/util/win/scoped_handle.cc$FindClose
                                                                                                                                                                                                                                                                                              • API String ID: 1863332320-1337471325
                                                                                                                                                                                                                                                                                              • Opcode ID: ef44879056bc12e27df0c924ab0292203110cebe2090a4ef07fa9c9e6304376d
                                                                                                                                                                                                                                                                                              • Instruction ID: c614c1f9988bccf02a7052bf09d70d065106659e3e6493975f33eca27079cc15
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ef44879056bc12e27df0c924ab0292203110cebe2090a4ef07fa9c9e6304376d
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9EF02E75F502086BCE057B68AC07FAD772C9F41710F40002AF9066B2C2FE346A1487D5
                                                                                                                                                                                                                                                                                              Function 001FCEA4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • ___std_exception_copy.LIBVCRUNTIME ref: 001FCEDA
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: ___std_exception_copy
                                                                                                                                                                                                                                                                                              • String ID: b"$b"
                                                                                                                                                                                                                                                                                              • API String ID: 2659868963-2617259577
                                                                                                                                                                                                                                                                                              • Opcode ID: a52739674691271b39b3f42f94245273f07c2b7b19e58f2653deeaeb842d6ea6
                                                                                                                                                                                                                                                                                              • Instruction ID: 905ee7526b5a33e4f3dfebbc8335237642ce8a0e7a9373d3d7e4650dfd101e1a
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a52739674691271b39b3f42f94245273f07c2b7b19e58f2653deeaeb842d6ea6
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DEF05EB09003159BC719DF19E8518ABFBF9EF89710B45C52EE88A4B390EB716544CB94
                                                                                                                                                                                                                                                                                              Function 0028EB90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18libraryloaderCOMMON
                                                                                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                                                                              • GetModuleHandleW.KERNEL32(00000000), ref: 0028EB9E
                                                                                                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 0028EBAA
                                                                                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                                                                                              • Source File: 0000000D.00000002.2701849702.00000000001F1000.00000020.00000001.01000000.00000011.sdmp, Offset: 001F0000, based on PE: true
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701827744.00000000001F0000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000357000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2701948120.0000000000385000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702014603.00000000003A0000.00000008.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702044985.00000000003A1000.00000004.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              • Associated: 0000000D.00000002.2702066905.00000000003AB000.00000002.00000001.01000000.00000011.sdmpDownload File
                                                                                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                                              • Snapshot File: hcaresult_13_2_1f0000_assistant_installer.jbxd
                                                                                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                                                                                              • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                                                                              • String ID: GetHandleVerifier
                                                                                                                                                                                                                                                                                              • API String ID: 1646373207-1090674830
                                                                                                                                                                                                                                                                                              • Opcode ID: bc25ad4d4d4e44c447d019bb24e4b6e27473c31e224c96409450bfbe6b2490d1
                                                                                                                                                                                                                                                                                              • Instruction ID: 3737b58355546e50d4e9b7577b7a53436e4d645079a72059ce9e2d874f98c199
                                                                                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bc25ad4d4d4e44c447d019bb24e4b6e27473c31e224c96409450bfbe6b2490d1
                                                                                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2AD05E342ADB04B7EE423BA1AC0AF29325C7B05B1EF114021F30A995D1CAA098218F97